Browser Hijacking

Browser hijacking is the covert modification or takeover of a web browser's behavior: changing the homepage or default search engine, redirecting navigation, injecting advertising, tracking every URL visited, or steering the user to attacker-controlled pages on command. The hijacker is usually software the user installed — a bundled program, a fake updater, or most commonly a browser extension that either was malicious from the start or turned malicious in a later update.

How it works

At the mild end, hijackers monetize attention: they reroute searches through pay-per-click intermediaries and inject ads, which is where browser hijacking overlaps with adware. At the serious end, the same access enables surveillance and attack staging. The RedDirection campaign disclosed in July 2025 showed the ceiling: 18 extensions on the Chrome and Edge stores, with more than 2.3 million installs, that tracked users' browsing, reported URLs with a unique tracking ID to an attacker server, and could redirect the browser when instructed — effectively a remotely steerable backdoor. Several had marketplace verification badges, featured placement, and years of clean history before a silent update armed them, a pattern examined in our guide to browser extension security risks. Because extensions auto-update, the user makes no mistake at all on the day the hijack begins.

A hijacked browser is also a delivery system: redirects can land users on phishing pages, fake update prompts, or malvertising chains that lead to malware.

How to defend against it

For organizations, govern the extension layer centrally: inventory installed extensions through enterprise browser management, allowlist what the business needs, review permission changes on update, and remove abandoned extensions. Watch for the user-visible symptoms — changed search engines, unfamiliar toolbars, redirects, a sudden surge of ads — and treat them as incident signals, not annoyances. And set the norm through awareness training that store ratings and badges are not safety guarantees; the decision to grant software a seat inside the browser deserves the same scrutiny as installing an application.