Poisoned Pipeline / Incidents / AS339
319 unlisted Chrome extensions sat between 13.4 million users and their searches
Socket published this on 29 October 2026. It is an extension of earlier
Socket research on search-hijacking listings, and it adds 264
extensions that had not been catalogued before, taking the total to 319
distinct Chrome Web Store listings installed by roughly 13.4 million
users. The oldest date back to 2016, so this is a decade of continuous
operation rather than a campaign with a start date. If the installs
were consolidated into one extension it would rank inside the current
top 25 by popularity.
The mechanics are deliberately minimal. In an extension's manifest, a
single setting overrides the browser's default search provider. No
JavaScript runs, no permissions are requested, no content scripts are
injected. Socket reproduces one listing whose entire content is that
manifest plus three icon files, pointing the search and autocomplete
URLs at search.safesearchgame.com and describing itself as real-time
safety alerts for game searches. Changing the default provider does
prompt the user at install time, but the prompt does not say where the
searches go. Because nothing is requested, reviewers who look only at
permissions conclude there is no risk.
Where the searches go is the operator's proxy, and from there the
operator decides. Most redirects Socket observed merely appended a
syndication partner tag and handed the query to Yahoo or Bing, which
run partner programmes that pay a revenue share on resulting ads and
assign tracking identifiers — a ypart tag for Yahoo, a cid for
Microsoft. But the destination is chosen per request, server-side. One
proxy with 50,000 users sent six identical searches to four different
places, including straight to Yahoo with partner tags, a hop through an
intermediate host before Yahoo, and a Cloudflare error page. The same
research saw a repeated search redirected to Google's homepage without
partner tags while other searches still went to Bing. Socket's reading
is that the referral revenue is the profitable base layer and the proxy
position is what makes a later selective redirect to a phishing page or
a malware lure possible for a chosen query, geography or client. No
such malicious redirect was observed, and the report says so.
Even without that step, the position is worth having. Every query
passes through the operator first and is tied to an identifier, so the
operator holds complete search histories; that can be segmented by
geography or IP and sold as trend or sentiment data, and it is what a
partner accounting reconciliation needs anyway.
Distribution is advertising, not discovery. Most of these listings are
unlisted in the Chrome Web Store — reachable by direct link or by
extension ID, invisible to store search and to indexers — so they are
found through pop-under and pop-over ads on low-quality ad inventory,
through Google Ads and Bidbrain, and through branded landing pages that
either offer an install button or redirect to the store after a couple
of seconds. Socket's hunting method chains those three artifacts: the
store page (or its absence from store search), the landing page linked
from the privacy policy, and the advertiser identity exposed through
Google Ads Transparency. From one landing page they reached BrightWorks
Technology LLC, an advertiser with more than 3,000 ads for other
extension downloads.
The operators are a small set of companies rather than independent
publishers. Intango LTD has published about 111 extensions reaching
roughly 2.2 million installs across about 279 domains, each extension
with its own domain and its own admin@ mailbox so every listing looked
like a separate small publisher, and most of them reporting to Yahoo
under Intango's partner account while 15 use Bing. Tightrope
Interactive ran about 200,000 Google ads across 307 domains. The 2024
SecuryBrowse wave — 58 extensions with security-sounding brands such as
Fire Shield, Wise Ghost and Securify, about 4.9 million users, many of
them requesting sensitive permissions on top of the search override —
is part of the same picture. From April 2025, 37 extensions pushing
Bing redirection through Bidbrain appeared, and in June 2026 fifteen
apparently independent publishers pushed updates within the same four
days, all carrying the same Bing partner tags. Named in the report
alongside those are System1 and its CodeFuel search-monetisation unit,
Inuvo, Digital Network Associates Online Marketing and Mutual Media.
Socket's argument for treating these as malicious rather than as
unwanted programs is that an extension whose only function is to
intercept searches the user could have made anyway, hidden from store
search, promoted through junk advertising and offering nothing in
return, has no purpose other than the interception. What the catalogue
can carry is narrower than that judgement: what was measured is
interception, collection and monetisation of search traffic at scale,
with the redirect capability demonstrated but not used against users in
any observed case.
Mapped techniques
- T0109 Publish malicious artifact
- T0110 Advertise malicious artifact
- T0197 Use code from untrusted source
supply-chain Hundreds of throwaway-looking Chrome Web Store listings
319 distinct listings installed by about 13.4 million users
since 2016, 264 of them new to this report. Most are unlisted,
so they are invisible to store search and reachable only by
link or extension ID.
Pop-under and pop-over ads on low-quality inventory, Google Ads
and Bidbrain campaigns, and branded landing pages that install
the extension or bounce the user to the store. One advertiser
alone runs more than 3,000 extension-download ads.
post-supply-chain Installs take the browser's search provider and keep it
The user installs from the Chrome Web Store. The install prompt
discloses that the default search provider will change, not
where the queries will be sent.
Framework gaps noted
- The core of the operation has no technique. Queries are taken to an operator-controlled proxy that decides, per request, whether to add a syndication partner tag or send the user somewhere else, and there is nothing in the vocabulary for intercepting the user's search provider or for collecting the query stream. T0212 covers subverted network routing (BGP, DNS, ARP), which is a different mechanism at a different layer.
- The persistence is a manifest setting, not code — one key that points the search and autocomplete URLs at the operator's host — so it does not fit T0138, and it survives page loads and restarts because the browser reads it, not because anything is installed on the host.
- Monetisation through Yahoo and Bing referral programmes is the attacker's revenue model, not a step of the intrusion.
- No malicious payload was observed. The selective malicious-redirect capability is demonstrated by the per-request behaviour of the proxy, not by any recorded redirect to phishing or malware, and the report frames it as possible rather than observed.
- How the listings passed store review is described only in the negative — no permissions, no code — so the reviews themselves are not evidence of a defeated control. The unlisted setting is a legitimate publisher option.