--- title: Searchjacked: Hidden Browser Extensions Hijack Searches... description: A total of 319 browser extensions installed by about 13.44 million users hijack search queries and collect referral payments from Yahoo and Bing. 200 of these... canonical: https://daily.dev/posts/searchjacked-hidden-browser-extensions-hijack-searches-for-13-million-users-7b8wcas60 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users | daily.dev og:description: A total of 319 browser extensions installed by about 13.44 million users hijack search queries and collect referral payments from Yahoo and Bing. 200 of these... og:url: https://daily.dev/posts/searchjacked-hidden-browser-extensions-hijack-searches-for-13-million-users-7b8wcas60 og:image: https://api.daily.dev/og/posts/7B8wCas60.png og:image:alt: Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users **[Socket](https://daily.dev/sources/socketdev)** · 4 min read · 1 upvotes · 0 comments ## Summary A total of 319 browser extensions installed by about 13.44 million users hijack search queries and collect referral payments from Yahoo and Bing. 200 of these extensions, covering roughly 5.68 million users, were traced to identified operators, including ad-tech company Intango LTD, maker of the Lumio browser, with 111 extensions and about 2.19 million users. Another 119 extensions with around 7.76 million users come from unknown operators, the largest being 'SecuryBrowse' at 58 extensions and roughly 4.9 million users. Extensions monetize through specific Yahoo partner IDs like hspart=iba and Bing codes like PC=3QCV, and one case includes an AliExpress affiliate redirector earning shopping commissions instead of search revenue. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How many browser extensions were found hijacking search queries and how many users were affected? 319 browser extensions installed by approximately 13.44 million users across a decade were found hijacking searches and capturing referral payments from Yahoo and Bing. Of these, 200 extensions with about 5.68 million users were traced to identified operators, while 119 extensions with roughly 7.76 million users came from unknown or anonymous publishers. _Developers auditing extension marketplaces for abuse can track findings like these on daily.dev._ ### Which company operates the most browser extensions tied to search hijacking monetization schemes? Intango LTD, an ad-tech company and maker of the Lumio browser, operates 111 extensions with about 2,187,000 users, the largest identified operator in a search hijacking scheme. It monetizes through a Yahoo partner ID (hspart=iba, account 5056) and a Bing code (PC=INES*) used across 15 extensions. _Anyone vetting browser extensions for supply chain risk can follow research like this on daily.dev._ ### What is the largest unknown operator group behind hijacked search extensions called? 'SecuryBrowse' is the largest unknown operator, linked to 58 extensions and approximately 4,901,000 users. It monetizes through Bing partner codes PC=3QCV and PC=3CGP, with tracking tags PTAG=1103, 1306, and 1309, though the entity behind the brand remains unidentified. _Security teams tracking unattributed browser threats can follow this kind of research on daily.dev._ ## Similar posts on daily.dev - [Spying Chrome Extensions: 287 Extensions spying on 37M users](https://daily.dev/posts/spying-chrome-extensions-287-extensions-spying-on-37m-users-zc89tp8r9) · Hacker News · 0 upvotes · 0 comments - [Newly discovered malicious extensions could be lurking in enterprise browsers](https://daily.dev/posts/newly-discovered-malicious-extensions-could-be-lurking-in-enterprise-browsers-i20gceevx) · CSO Online · 0 upvotes · 0 comments - [260K\+ Chrome Users Duped by Fake AI Browser Extensions](https://daily.dev/posts/260k-chrome-users-duped-by-fake-ai-browser-extensions-ftkuwa8pg) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#devtools](https://daily.dev/tags/devtools), [#google-chrome](https://daily.dev/tags/google-chrome) [View this post on daily.dev](https://daily.dev/posts/searchjacked-hidden-browser-extensions-hijack-searches-for-13-million-users-7b8wcas60) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users","url":"https://daily.dev/posts/searchjacked-hidden-browser-extensions-hijack-searches-for-13-million-users-7b8wcas60","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/searchjacked-hidden-browser-extensions-hijack-searches-for-13-million-users-7b8wcas60"},"datePublished":"2026-10-29T03:10:08.439Z","dateModified":"2026-10-29T15:16:29.740Z","description":"A total of 319 browser extensions installed by about 13.44 million users hijack search queries and collect referral payments from Yahoo and Bing. 200 of these...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4afd0e67b76e817588ab60c5d68575b5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4afd0e67b76e817588ab60c5d68575b5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Socket","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Socket","logo":"https://media.daily.dev/image/upload/s---oEn9czC--/f_auto/v1716187892/logos/socketdev","url":"https://daily.dev/sources/socketdev"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/searchjacked-hidden-browser-extensions-hijack-searches-for-13-million-users-7b8wcas60","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,devtools,google-chrome","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Socket","item":"https://daily.dev/sources/socketdev"},{"@type":"ListItem","position":3,"name":"Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/searchjacked-hidden-browser-extensions-hijack-searches-for-13-million-users-7b8wcas60#faq","mainEntity":[{"@type":"Question","name":"How many browser extensions were found hijacking search queries and how many users were affected?","acceptedAnswer":{"@type":"Answer","text":"319 browser extensions installed by approximately 13.44 million users across a decade were found hijacking searches and capturing referral payments from Yahoo and Bing. Of these, 200 extensions with about 5.68 million users were traced to identified operators, while 119 extensions with roughly 7.76 million users came from unknown or anonymous publishers. Developers auditing extension marketplaces for abuse can track findings like these on daily.dev."}},{"@type":"Question","name":"Which company operates the most browser extensions tied to search hijacking monetization schemes?","acceptedAnswer":{"@type":"Answer","text":"Intango LTD, an ad-tech company and maker of the Lumio browser, operates 111 extensions with about 2,187,000 users, the largest identified operator in a search hijacking scheme. It monetizes through a Yahoo partner ID (hspart=iba, account 5056) and a Bing code (PC=INES*) used across 15 extensions. Anyone vetting browser extensions for supply chain risk can follow research like this on daily.dev."}},{"@type":"Question","name":"What is the largest unknown operator group behind hijacked search extensions called?","acceptedAnswer":{"@type":"Answer","text":"'SecuryBrowse' is the largest unknown operator, linked to 58 extensions and approximately 4,901,000 users. It monetizes through Bing partner codes PC=3QCV and PC=3CGP, with tracking tags PTAG=1103, 1306, and 1309, though the entity behind the brand remains unidentified. Security teams tracking unattributed browser threats can follow this kind of research on daily.dev."}}]} ```