Loading threat actor…
Bing-Search is an unidentified, financially motivated operator associated with a cluster of 37 Chrome search-hijacking extensions with approximately 2.21 million reported users. The cluster's extensions began appearing in April 2025 and were promoted through Bidbrain advertisements. Its operators monetize redirected search traffic through Bing search-syndication arrangements. The Bing-Search designation identifies an unattributed activity cluster, not Microsoft or an established corporate identity. The extensions alter the browser's default search provider and route searches through operator-controlled infrastructure before forwarding them to Bing with advertising attribution parameters. This arrangement generates advertising commissions and exposes search queries to intermediary infrastructure. Shared Bing partner identifiers and coordinated updates across 15 apparently independent publishers within four days in June 2026 linked the extensions to a common operator. The operator's identity, country of origin, and geographic targeting are unknown. Phishing or malware delivery through this cluster's search-routing infrastructure has not been demonstrated.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.