Malware · 4h ago

Chrome extensions hijack searches for referral payments

Socket identified 319 Google Chrome extensions used by about 13.44 million people over a decade that redirect searches and collect referral payments. The investigation linked the largest group—200 extensions—to Intango LTD and identified multiple other operators.

The extensions send searches to Yahoo or Bing with a partner code attached. If the visit generates revenue, the code can credit the extension publisher with a referral payment, even though the user did not choose that search route. The handoff also sends the search query to the provider.

For organizations where staff use Chrome to search sensitive work topics, those queries can reveal work-related intent to the search provider while generating revenue for an extension publisher. Because the pattern spans publishers, removing one extension would not establish that the broader exposure is gone.

Timeline

Sources

1 source covering this story

Vendor digest: Microsoft

Part of the PlainSec briefing for 2026-10-29

Editions