Loading threat actor…
SecuryBrowse is an unidentified browser-extension operator associated with a financially motivated search-hijacking cluster comprising 58 Chrome extensions and approximately 4.9 million reported users. The cluster was associated with a 2024 campaign wave using plausible security-themed branding. Its reported user total does not establish current active exposure. The operator’s identity and geographic origin are unknown. SecuryBrowse extensions alter the browser’s default search provider and route searches through operator-controlled intermediaries before forwarding them to Bing. Search-syndication identifiers associate redirected traffic with revenue-generating referral accounts. This routing exposes search queries to the intermediary operator and gives it control over subsequent destinations. The extensions frequently request sensitive browser permissions in addition to changing search settings. The established activity centers on search interception and advertising monetization. Phishing or malware delivery through SecuryBrowse’s routing infrastructure has not been established.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.