Socket researcher John Tuckner identified 319 Chrome Web Store extensions with a combined 13.4 million reported installations covertly redirecting users' searches through operator-controlled proxy servers to harvest Bing and Yahoo advertising referral payments. The research extends Tuckner's April 2025 disclosure of 57 extensions with 6 million users, adding 264 newly identified add-ons with another 8.7 million. The extensions pose as PDF converters, manual finders, safe-search and AI tools; most are unlisted on the store and promoted via shady ads, and need almost no code — Chrome's built-in settings override lets them replace the default search provider with only a manifest and icons. Tuckner warns the operator can change each search's final destination at any time without shipping an update, including redirecting to phishing sites or malicious downloads — demonstrated by the Predator Search extension, which routed six identical searches to four different destinations. Most extensions were removed by publication, but new ones are continuously added. Users should uninstall them and run a full AV scan.

• Source article