Severity: Medium | Priority: 2
This update adds signatures that detect browsers in your network using search-hijacking extensions identified in newly published research. The research tracks more than 300 Chrome extensions with around 13 million users that have quietly replaced the browser’s default search engine. Many of them look harmless or are almost invisible: they have no icon, no settings page and no permissions beyond changing the search provider. Some advertise features such as “real-time safety alerts” that they never actually provide.
Once installed, every search the user types and every suggestion lookup goes first to the operator’s server rather than to the search engine the user expects. The server decides where to send each query, usually to a mainstream search engine carrying the operator’s affiliate tag, and sometimes through redirect chains or unrelated landing pages. The operator earns advertising revenue on each search. It can also see the user’s full search history, often tied to a unique identifier. That can expose sensitive business information, internal project names, customer details and personal searches typed by employees.