SearchJack Chrome Extensions Hijack User Searches

SearchJack Campaign Uses 23 Chrome Extensions to Hijack User Searches

Introduction:

A coordinated campaign known as SearchJack has used 23 deceptive Chrome browser extensions to hijack user searches at scale.

The campaign reportedly affected roughly 758,000 Chrome users worldwide.

Each extension presented itself as a useful browser tool, including search helpers, map utilities, productivity tools, video tools, login helpers, and new tab enhancements.

Behind the scenes, however, the extensions changed the browser’s default search behavior and routed user queries through operator-controlled relay systems.

For everyday users, this means their searches may have been silently redirected through monetization infrastructure without clear consent.

For enterprises, the incident is a serious browser security warning.

Browser extensions can sit directly between users, search behavior, cloud applications, web sessions, credentials, and business workflows.

When extensions are deceptive, they can become a quiet surveillance and redirection layer inside the browser.

What Happened:

Researchers identified a coordinated campaign involving 23 Chrome extensions that hijacked browser search activity.

The operation was named SearchJack.

The extensions appeared to offer legitimate functionality, but many were designed mainly to override default search settings.

Once installed, they used Chrome’s built-in chrome_settings_overrides capability to change how searches were handled.

When a user typed a search query, the request passed through operator-controlled relay servers before reaching the final search results page.

To the user, the experience may have looked mostly normal.

In the background, every query moved through a hidden monetization path.

Researchers traced the activity to multiple affiliate brokers and redirect networks connected to search monetization.

Why This Issue Is Critical:

This issue is critical because search activity can reveal highly sensitive user intent.

Search queries may expose business projects, medical concerns, legal issues, financial planning, customer research, technology stack details, security questions, login portals, internal vendor names, and incident response activity.

Even when a search hijacker does not steal passwords directly, it can still collect valuable behavioral intelligence.

Search queries can reveal what a user is trying to access, what problems they are trying to solve, and what systems or services they use.

For enterprises, that creates reconnaissance risk.

A malicious or deceptive extension can quietly observe user behavior and redirect traffic without looking like traditional malware.

How the SearchJack Extensions Worked:

The SearchJack extensions relied on browser configuration abuse rather than highly complex malware.

Many of the extensions were simple shell extensions.

They contained little more than the manifest configuration needed to change the browser’s default search engine.

That approach helped the extensions appear lightweight and low-risk.

Some extensions added fake or minimal functionality, such as maps, video libraries, or search switching interfaces.

Those features helped make the extensions look useful enough to pass casual review.

However, the real purpose was search redirection.

Even when users believed they were choosing a search provider, the traffic still passed through operator-controlled infrastructure.

The Role of chrome_settings_overrides:

The campaign abused Chrome’s chrome_settings_overrides feature.

This feature allows extensions to change browser settings such as the default search provider, homepage, or new tab behavior.

Legitimate extensions may use this capability for valid customization.

SearchJack used it to redirect search traffic.

That matters because the behavior can happen without obvious warning signs after installation.

The user may continue using the browser normally while the extension quietly controls the path of search traffic.

This makes search hijacking difficult for non-technical users to notice.

It also makes browser extension governance important for organizations.

The Broker and Affiliate Monetization Layer:

The SearchJack campaign used a layered broker and affiliate monetization structure.

Researchers identified multiple affiliate brokers through tracking parameters in redirect URLs.

These brokers appear to have revenue-sharing arrangements tied to search traffic.

Each search can generate value when routed through affiliate systems.

That creates a financial incentive to hijack searches at scale.

The concern is not only unwanted monetization.

The same routing control could potentially be abused to redirect users toward phishing pages, malicious downloads, scam sites, fake support pages, or credential-harvesting infrastructure.

If operators control the redirection layer, they can change destinations without requiring a new extension update.

That makes the risk more serious than ordinary adware.

Deceptive Privacy Claims:

One of the most concerning parts of the campaign is the gap between user-facing claims and actual data practices.

Some extensions reportedly claimed they did not track searches or collect personal data.

However, linked privacy policies disclosed collection of data such as IP addresses, search queries, and device identifiers.

That mismatch creates both security and privacy concerns.

Users may install an extension because they believe it is safe and respectful of privacy.

In reality, their search activity may be routed, tracked, and monetized.

For organizations subject to privacy obligations, unmanaged extensions can create compliance exposure if employee browsing data is collected by unknown third parties.

How the Attack Chain Could Work:

A realistic SearchJack-style abuse path may follow this pattern.

• A user finds a Chrome extension that appears to offer maps, search tools, productivity features, or new tab customization
• The extension looks harmless and requires few obvious permissions
• After installation, it changes the default search provider using browser configuration features
• User searches begin routing through operator-controlled relay domains
• The user receives normal-looking search results and may not notice the redirection
• Search queries, IP addresses, device identifiers, and routing metadata may be collected
• Affiliate brokers monetize the redirected search traffic
• Operators retain the ability to alter traffic routing later
• The same infrastructure could potentially direct users toward phishing pages or malicious downloads

This attack chain shows how browser extensions can create persistent risk without deploying obvious malware.

Why This Incident Matters for Cybersecurity:

This incident reinforces a major cybersecurity reality.

Browser extensions are part of the endpoint attack surface.

They run inside the browser, interact with user activity, modify settings, and may influence traffic flow.

Organizations often focus heavily on endpoint protection, firewalls, identity tools, and patching while allowing users to install browser extensions freely.

That creates a blind spot.

A browser extension does not need full system access to create risk.

If it controls search behavior, observes queries, redirects traffic, or influences what pages users reach, it can support surveillance, monetization abuse, phishing, and future compromise paths.

SearchJack also highlights the problem of disposable extensions.

Removing one extension may not stop the broader campaign if the same operators can publish new extensions, reuse domains, or continue through affiliate accounts.

Common Risks Highlighted:

This SearchJack campaign highlights several common enterprise weaknesses.

• Unmanaged Chrome extension installation
• Lack of extension allowlisting
• Browser settings controlled by user-installed extensions
• Weak review of extension privacy claims
• Limited monitoring of search provider changes
• Inadequate visibility into browser redirect chains
• Search traffic routed through unknown third-party domains
• Employees installing low-value productivity extensions
• Poor correlation between browser changes and suspicious network activity
• Overreliance on Chrome Web Store presence as a trust signal

These weaknesses can allow deceptive extensions to persist quietly across user browsers.

Potential Impact:

The potential impact of search hijacking depends on the extension’s behavior and the operator’s intent.

Possible consequences include the following.

• Search query collection
• IP address tracking
• Device identifier collection
• Browser behavior profiling
• Traffic monetization without consent
• Redirection through unknown infrastructure
• Exposure to phishing pages
• Exposure to malicious downloads
• Privacy compliance concerns
• Employee reconnaissance risk
• Reduced trust in browser security

Even when the immediate activity appears monetization-focused, the ability to control search routing creates future security risk.

What Organisations Should Do Now:

Organizations should review browser extension exposure immediately.

• Audit installed Chrome extensions across managed endpoints
• Remove unknown, unnecessary, or low-trust extensions
• Review whether any SearchJack-related extensions are present
• Enforce an approved extension allowlist
• Block extensions that override search settings without business justification
• Monitor changes to default search providers
• Restrict extension installation for high-risk users
• Review browser management policies through enterprise controls
• Educate users about deceptive extension listings
• Validate privacy claims before approving extensions
• Monitor DNS and proxy logs for suspicious search redirect domains
• Review whether search traffic is passing through unknown relay infrastructure

Browser extension governance should be treated as a core endpoint control.

A browser with unmanaged extensions is not fully managed.

Detection and Monitoring Strategies:

Security teams should monitor for indicators of browser extension abuse.

• Changes to Chrome default search provider settings
• Installation of unfamiliar search, map, video, new tab, or login helper extensions
• Browser traffic routed through unknown search relay domains
• Repeated redirects before search result pages load
• DNS requests to suspicious extension-linked domains
• Chrome extension IDs not approved by policy
• Users reporting changed search behavior
• Extensions with mismatched privacy claims and behavior
• Browser policies modified outside approved management tools
• Affiliate tracking parameters appearing in search URLs

Detection should focus on both browser state and network behavior.

The extension may look simple, but the redirect path can reveal the abuse.

The Role of Incident Response Planning:

Incident response teams should prepare for browser extension compromise and abuse scenarios.

If a deceptive extension is discovered, responders should identify affected users, remove the extension, reset search settings, and review browser policies.

They should also review DNS, proxy, and endpoint logs to determine how long search traffic was redirected.

If users were routed through suspicious infrastructure, teams should investigate whether phishing, credential harvesting, or malicious downloads occurred.

For high-risk users, such as executives, administrators, finance teams, developers, and security staff, additional review may be necessary.

Search activity can reveal sensitive intent and operational information.

That data exposure should not be dismissed as harmless.

Penetration Testing Insight:

From a penetration testing perspective, SearchJack shows why browser extension controls should be included in enterprise assessments.

Many organizations test endpoint malware defenses but do not test whether browser extensions can manipulate user behavior or traffic.

That leaves a gap.

• Review browser extension installation policies
• Test whether users can install unapproved extensions
• Assess controls around default search provider changes
• Validate extension allowlisting
• Review risky extension categories
• Analyze installed extensions for suspicious permissions and behavior
• Test monitoring for search redirection
• Review DNS visibility into extension-related domains
• Validate removal and remediation procedures
• Assess whether high-risk users have stricter browser controls

Modern penetration testing should evaluate the browser as an enterprise security boundary.

Expert Insight:

James Knight, Senior Principal at Digital Warfare, said:

“SearchJack shows that browser extensions do not need advanced malware capabilities to create enterprise risk. If an extension can control search behavior, route traffic, and collect user intent, it becomes a quiet intelligence layer inside the browser.”

What Security Leaders Should Prioritize:

Security leaders should treat this campaign as a browser governance warning.

The immediate priority is identifying and removing deceptive extensions.

The broader priority is enforcing browser extension control across the enterprise.

Leaders should ask direct questions.

Which Chrome extensions are installed across managed devices?

Which extensions can change search settings?

Do users have permission to install unapproved extensions?

Can we detect browser search hijacking?

Can we block risky extension categories?

Can we distinguish legitimate search traffic from redirected traffic?

If teams cannot answer those questions quickly, the organization has a browser security visibility gap.

Call to Action:

Organizations should not assume browser extensions are harmless because they come from an official store.

Audit Chrome extensions, enforce allowlisting, monitor search provider changes, and confirm that deceptive browser tools cannot hijack user searches or expose business intent.