Skip to navigation

Threat reportMalwareTL-2026-4753

Chrome Extension Search-Hijacking Campaign ("Searchjacked"): 319 Extensions, 13.4M Installs, Queries Proxied via Operator Servers to Bing/Yahoo

mediumACTIVE

Socket (research by John Tuckner) documented 319 Chrome extensions, with 13.4 million combined installs, that use the chrome_settings_overrides manifest key to replace the default search provider and route every query through operator-controlled proxy/tracking servers before forwarding to Yahoo or Bing for affiliate revenue. First disclosed .

Key facts for Searchjacked Chrome extension hijack

IdentifiersTL-2026-4753
Also known asSearchjacked, SearchJack-style extension search hijacking
SeverityMEDIUM
First disclosed
Exploitation statusExploited in the wild
Affected productsGoogle Chrome Web Store extensions (319 search-hijacking extensions)
MalwareBing-Search cluster, HermesTab, Predator Search, SecuryBrowse
MITRE ATT&CK techniquesT1036.005 Match Legitimate Resource Name or Location, T1071.001 Web Protocols, T1090.002 External Proxy, T1176.001 Browser Extensions, T1557 Adversary-in-the-Middle, T1565.002 Transmitted Data Manipulation, T1583.001 Domains, T1583.008 Malvertising
MotivationFINANCIAL
Target sectorsconsumer, enterprise
Target regionsGlobal
Detection rules9 (1 shown free)
Sources7 cited sources

Detection coverage for Searchjacked Chrome extension hijack

As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4753 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Searchjacked - Search Traffic Carrying Operator Yahoo hspart / Bing PC Partner Codes

Web proxy detection for search URLs carrying the Yahoo hspart partner IDs (iba=Intango LTD, flowsurf=Kinner Lake Ltd, bc=Free Planet VPN S.R.L, fc=Perion/CodeFuel) or the Bing PC partner codes (3QCV/3CGP SecuryBrowse cluster, 3FPX/3VSS Bing-Search cluster) documented in Searchjacked (TL-2026-4753). These monetisation parameters are appended by operator search proxies that sit between the user and Yahoo/Bing, so their presence in a host's search traffic indicates a hijacked default search provider (adversary-in-the-middle on queries). Output lists the destination hosts per client so selective redirection to unexpected destinations is visible.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1557, T1090.002, T1071.001, T1565.002
  • Data sources: web_proxy, pan:url, zscalernss-web, CommonSecurityLog
  • Severity: medium
  • Confidence: medium

Splunk SPL

index=proxy (sourcetype="pan:url" OR sourcetype="zscalernss-web") earliest=-24h
| eval u=lower(coalesce(url, request_url))."&"
| where match(u, "[?&]hspart=(iba|flowsurf|bc|fc)[^a-z0-9]") OR match(u, "[?&]pc=(3qcv|3cgp|3fpx|3vss)[^a-z0-9]")
| eval partner_param=replace(u, ".*[?&](hspart=[a-z0-9]+|pc=[a-z0-9]+).*", "\1"), dest_host=replace(u, "^(?:https?://)?([^/:?]+).*", "\1")
| stats count as hits dc(dest_host) as distinct_dest_hosts values(dest_host) as dest_hosts values(partner_param) as partner_params min(_time) as first_seen max(_time) as last_seen by src, user
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL matches regex @"(?i)[?&]hspart=(iba|flowsurf|bc|fc)(&|$)" or RequestURL matches regex @"(?i)[?&]pc=(3qcv|3cgp|3fpx|3vss)(&|$)"
| extend PartnerParam = extract(@"(?i)[?&](hspart=[a-z0-9]+|pc=[a-z0-9]+)", 1, RequestURL)
| summarize Hits = count(), DestHosts = make_set(DestinationHostName, 10), PartnerParams = make_set(PartnerParam, 10), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, SourceUserName

Sigma

title: Search Request with Searchjacked Yahoo hspart or Bing PC Partner Code
id: e5a2c8f1-6d37-49b0-8c14-3f7a90d2b5e6
status: experimental
description: Detects web proxy requests whose URL carries Yahoo hspart partner IDs or Bing PC partner codes tied by Socket to Searchjacked search-hijacking extension operators (Intango, Kinner Lake, Free Planet VPN, Perion/CodeFuel, SecuryBrowse and Bing-Search clusters). TL-2026-4753.
references:
    - https://socket.dev/blog/searchjacked
    - https://www.bleepingcomputer.com/news/security/chrome-extensions-with-134-million-installs-caught-hijacking-searches/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/10/29
tags:
    - attack.collection
    - attack.t1557
    - attack.command-and-control
    - attack.t1090.002
    - attack.t1071.001
    - attack.impact
    - attack.t1565.002
logsource:
    category: proxy
detection:
    selection_yahoo:
        c-uri|contains:
            - 'hspart=iba'
            - 'hspart=flowsurf'
            - 'hspart=bc&'
            - 'hspart=fc&'
    selection_bing:
        c-uri|contains:
            - 'PC=3QCV'
            - 'PC=3CGP'
            - 'PC=3FPX'
            - 'PC=3VSS'
    condition: selection_yahoo or selection_bing
falsepositives:
    - Legitimate users of products that monetise search through the same partner programs (for example an installed VPN client)
    - Short partner codes such as bc and fc may collide with unrelated Yahoo partners
level: medium

Known false positives:

  • Hosts with a legitimately installed product that uses the same Yahoo/Bing partner programs (e.g. Free Planet VPN client) will match
  • Short partner IDs hspart=bc and hspart=fc may overlap with other partners' traffic

Tuning notes: Field names (url/request_url, src, user) follow common proxy CIM mappings; map to your proxy's fields. Prioritise hosts where distinct_dest_hosts is above 1, which indicates server-side routing to several destinations as seen with Predator Search. Add newly published hspart/PC codes from Socket and Intango-related research to the patterns.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Searchjacked - Malvertising Ad-Network Hop Followed by Chrome Web Store Extension Page · unlock with TL Creds
  • Searchjacked - Chrome/Edge Preferences File Modified by Non-Browser Process · unlock with TL Creds
  • Searchjacked - Connections to Known Search-Proxy Operator Domains (Proxy and Endpoint) · unlock with TL Creds
  • Searchjacked - Chromium Browser Launched with Side-Loaded Extension Arguments · unlock with TL Creds
  • Searchjacked - External Browser Extension Registered via Registry (update_url / path) · unlock with TL Creds
  • Searchjacked - DNS Resolution of Search-Proxy Operator Domains · unlock with TL Creds
  • Searchjacked - Chrome Extension Manifest Dropped (Known Predator Search ID, Non-Browser Writer or First-Seen Extension) · unlock with TL Creds
  • Searchjacked - Chrome Policy Registry Tampering for Forced Extensions or Default Search Provider · unlock with TL Creds

Indicators of compromise for Searchjacked Chrome extension hijack

As of 2026-10-29, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-4753.

Sample indicators (3 of 20)

  • Domain: searchlio[.]net
  • Domain: searchtosearch[.]com
  • Domain: mcftink[.]com

Defanged, TLP:CLEAR. Full set of 20 indicators: unlock with TL Creds.

20 indicators of compromise · unlock with TL Creds. Compare plans

How Searchjacked Chrome extension hijack works

The proxy architecture lets operators selectively redirect to phishing pages or malicious downloads; most listed extensions had been removed from the Chrome Web Store by publication.

Socket's "Searchjacked" report (published 2026-10-29) and BleepingComputer's coverage describe a decade-long (2016-2026) search-hijacking ecosystem consisting of 319 Chrome extensions with roughly 13.4 million combined installs. BleepingComputer reports that 57 of these extensions (about 6 million users) were identified by researcher John Tuckner in April 2025 and that 264 more (about 8.7 million users) were newly identified. Note: the BleepingComputer URL slug says 134 million while the article body and Socket say 13.4 million, and the sub-figures in the article do not sum exactly to 13.4M; the body figure is used here.

Technique: the extensions rely on Chrome's legitimate chrome_settings_overrides manifest key to define a new search provider and make it the default. Socket notes that many extensions need almost no code: a manifest containing only icon files and the chrome_settings_overrides section pointing at an operator domain, with no background service worker and no sensitive permissions. Queries pass through an operator proxy that decides server-side where to send the user: Yahoo (monetized via hspart/hsimp partner parameters), Bing (monetized via PC= partner codes and PTAG= sub-IDs), or other destinations. The Predator Search extension (about 50K users) was observed routing six identical searches to four different destinations, including Yahoo, searchlio.net, searchtosearch.com, and error pages. Because routing is server-side, operators can wait for data to accumulate and then redirect targets to phishing sites or malicious downloads; no such malicious redirection is stated as observed in the sources.

Distribution: extensions masquerade as PDF converters, manual finders, safe search, and AI search tools. Most are unlisted in Chrome Web Store search and reached through pop-over/pop-under and shady website ads (Google Ads, Bidbrain and ad exchanges) leading to single-button landing pages that redirect to the Web Store listing. Socket reports a June 2026 event in which 15 apparently independent publishers pushed coordinated updates within four days using identical Bing tags.

Operators and clusters per Socket: 200 extensions (~5.68M users) were tied to identifiable companies, including Intango LTD (111 extensions, ~2.2M users, 279 domains, Yahoo hspart=iba), Tightrope Interactive (18 extensions, ~122K users), System1, Inc. (9, ~91K), Kinner Lake Ltd (6, ~300K, hspart=flowsurf), Free Planet VPN S.R.L (1, ~2M, hspart=bc), Capital Intellect, Inc. (2, ~50K), and Perion Network/CodeFuel (4, ~50K, hspart=fc), plus BrightWorks Technology LLC, ValidClick/Inuvo, Mutual Media, Vimaok Limited and VPP Technologies. 119 extensions (~7.76M users) had unknown operators, including the SecuryBrowse cluster (58 extensions, ~4.9M users, Bing PC=3QCV/3CGP), the Bing-Search cluster (37 extensions, ~2.2M users, Bidbrain-promoted, PC=3FPX/3VSS), HermesTab (2 extensions, ~400K users, 2017 Yahoo new-tab hijacker) and a Russian-language Yandex search extension (~200K users, active since 2016).

Impact: every search query is visible to the operator and potentially tied to unique identifiers; operators monetize via search-syndication referral revenue and can aggregate trend data. The sources do not report credential theft or code execution, so severity is an analyst judgment of MEDIUM. Removed extensions are being replaced by new domains and lures.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location

Command and Control

T1071.001 Web Protocols; T1090.002 External Proxy

Persistence

T1176.001 Browser Extensions

Collection

T1557 Adversary-in-the-Middle

Impact

T1565.002 Transmitted Data Manipulation

Resource Development

T1583.001 Domains; T1583.008 Malvertising

Remediation for Searchjacked Chrome extension hijack

Immediate actions

  • Inventory browser extensions across the fleet and remove those listed in Socket's Searchjacked report
  • Check the default search provider in Chrome (chrome://settings/search) and reset it if it points to an unexpected provider
  • Block or alert on the proxy domains searchlio.net, searchtosearch.com, mcftink.com, extension-search.online, newtabsearch.net, newtabhub.net and safesearchgame.com at DNS/web proxy
  • Run a full endpoint scan after removing the extensions

Workarounds

  • Use Chrome Enterprise policy DefaultSearchProviderEnabled/DefaultSearchProviderSearchURL to lock the default search provider

Longer-term hardening

  • Enforce an extension allowlist via Chrome Enterprise policy (ExtensionInstallAllowlist / ExtensionInstallBlocklist)
  • Block installation of unlisted Chrome Web Store extensions and extensions that override the default search provider
  • Monitor web proxy logs for search traffic to unfamiliar search domains carrying Yahoo hspart= or Bing PC= partner parameters
  • Educate users to avoid installing add-ons promoted by website ads or from unknown publishers

Affected and fixed versions

  • Google — Chrome Web Store extensions (319 search-hijacking extensions)
    Vulnerable versions: Google Chrome with any of the 319 listed extensions installed
    Fixed in: Extension removal / default search provider reset

Timeline of Searchjacked Chrome extension hijack

  • Earliest activity in Socket's dataset: a Russian-language Yandex search-hijacking extension (~200K users) using locked-ioc-2 (date is year-only per source)
  • locked-ioc-19 Yahoo new-tab hijacker extensions (2 extensions, ~400K users) appear (date is year-only per source)
  • locked-ioc-16 wave (58 extensions, ~4.9M users, Bing PC=3QCV/3CGP monetization) appears with sensitive permissions (date is year-only per source)
  • John Tuckner (Secure Annex) publishes research on 35 unlisted Chrome extensions with 4M+ installs; BleepingComputer cites 57 extensions (~6M users) identified in April 2025
  • Socket reports 37 further extensions launched in April 2025 following the earlier research release (day is approximate; source gives month only)
  • 15 seemingly independent publishers push coordinated updates within four days using identical Bing tags (day approximate; source gives month only)
  • Socket publishes Searchjacked report on 319 extensions / 13.4M users; BleepingComputer reports most extensions already removed from the Chrome Web Store while new ones keep appearing

Sources cited for Searchjacked Chrome extension hijack

Drafted by the Threadlinqs research pipeline from 7 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats