Browser Hijacking

What it is

Browser hijacking is the unauthorized alteration of browser behavior, such as changing the homepage, search provider, proxy settings, or displayed advertisements. It often comes from unwanted software or extensions. Not every redirect means hijacking: websites can redirect legitimately, so persistent changes across unrelated sites are more informative than a single unusual page.

How it works

A bundled installer or extension changes settings and may add persistence so those settings return after you fix them. Some hijackers inject ads, collect browsing data, or route searches through services that earn revenue. A malicious proxy or deeper device infection can affect several browsers rather than one extension alone.

How people get tricked

Preselected installation extras look like required components. An extension may initially appear useful and later change behavior. Users may repeatedly reset the homepage without removing the software that keeps overriding it.

Example scenario

Every new browser tab opens an unfamiliar search service, and changing the setting works only until restart. An unwanted extension or installed application is reapplying the change.

Warning signs

• Search, homepage, or proxy settings change without your approval.
• New extensions appear or removed settings return after restart.
• Advertisements and redirects occur across unrelated websites.

If it happens to you

Remove suspicious extensions and applications, inspect browser and network settings, and run trusted security checks. A browser reset may help after the cause is removed. If the unwanted software could read account pages, use a clean device to revoke sessions and change exposed credentials.