Fake PDF and Search Extensions Hijacked 13.4 Million Chrome Users

Ads for browser extensions that promised PDF conversion, manual finding, or "safe" search landed on the Chrome Web Store. According to Malwarebytes, more than 319 of those extensions were installed on an estimated 13.4 million devices over the past decade. Once installed, they changed the default search engine, sent every query through servers the creators controlled, and then forwarded the results to Yahoo or Bing. The result was a massive, covert data‑collection operation.

How the extensions operated

The extensions were marketed as productivity tools, ‑ "manual finder", "PDF converter", "AI search", ‑ and were promoted through ad networks, including Google Ads. When a user clicked an ad, the landing page encouraged a quick install. Because many of the extensions were listed as unlisted in the Chrome Web Store, they did not appear in normal search results. A direct link was all that was needed to reach the installation page.

Once installed, the extension changed Chrome’s default search engine setting. Instead of sending a query directly to the user‑chosen engine, the extension routed the request to a proxy server owned by the extension’s operator. The proxy logged the full query, attached a unique identifier, and then passed the request to a legitimate search provider such as Yahoo or Bing. The provider returned the results, which the proxy forwarded back to the user’s browser. In this way, the operator could see every search term a user entered, ‑ from health concerns to financial questions, ‑ and could potentially link multiple searches to the same individual.

Scope and impact

Socket researcher John Tuckner identified 319 extensions that together accounted for about 13.4 million installs. The extensions have been in circulation for roughly ten years, meaning a large portion of the install base is likely still active. Because the extensions were listed in the official Chrome store, users trusted the source, even though most entries were hidden from casual browsing. The sheer number of affected devices makes this one of the larger, long‑running search‑hijacking campaigns discovered in recent years.

Risks to users

The primary risk is the exposure of search queries. Queries can reveal sensitive information about a person’s health, finances, employment, or personal interests. When tied to a persistent identifier, an operator could build a profile of a user’s interests and habits over time.

A secondary risk is the ability of the proxy to choose where to send a query. While Malwarebytes did not find direct evidence that the extensions redirected users to phishing or malware sites, the technical capability existed. An attacker could have altered results to point to malicious pages, increasing the chance of further compromise.

What you can do now

• Review installed extensions, Open Chrome and navigate to chrome://extensions. Look for any extensions you do not recognize, no longer need, or that you installed after clicking an advertisement. Click Remove and confirm.
• Check your search settings, In Chrome, open the three‑dot menu, choose Settings > Search engine. If an extension is listed as controlling the default search engine, either switch back to your preferred engine or remove the controlling extension.
• Run a Malwarebytes scan, Use Malwarebytes to scan for malicious extensions and other unwanted software. The tool can flag known bad extensions and help you clean them out.
• Cross‑check with public lists, Socket published a list of the identified extensions. Compare the names you see in your Chrome installation with that list to spot any that are known to be malicious.
• Limit future installations, Only install extensions from sources you trust, and avoid clicking ads that promise quick fixes for PDF conversion or "safe" searching. When possible, use the Chrome Web Store’s search function rather than direct links.

Preventing future hijacks

• Enable Chrome’s extension verification, Keep Chrome updated so it can automatically block known harmful extensions.
• Use multi‑factor authentication on your Google account, This adds a layer of protection in case an attacker tries to manipulate your account settings.
• Educate staff and volunteers, Make sure everyone who uses a company or organization Chrome browser understands the risk of installing extensions from ads.
• Consider a browser policy, For organizations, enforce a policy that restricts which extensions can be installed on work devices. Centralized management tools can whitelist approved extensions and block everything else.

By taking these steps, you can remove existing threats and reduce the chance that similar ad‑driven hijacking campaigns affect your team in the future.