Identify a Browser Hijacker on Linux

Recognising the signs of a hijacked browser

Browser hijacking can be subtle, but there are often clear indicators. Keep an eye out for these common symptoms in Firefox or Chrome:

Your homepage or new tab page has changed without your permission.
Your default search engine is different, and your searches are redirected through an unfamiliar site.
New, unwanted toolbars or extensions have appeared in your browser.
You're seeing an excessive amount of pop-up ads, even on sites that don't usually display them.
Your browser is significantly slower than usual, or crashing frequently.

Good to know

Many of these symptoms can also be caused by legitimate software or browser settings. The key is if these changes happened without your consent.

The first step is to check your browser's extensions and settings. This process is similar for both Firefox and Chrome on Linux.

For Google Chrome: Type chrome://extensions into your address bar and press Enter. Review the list for any extensions you don't recognise. Toggle off and then click Remove for suspicious ones. Next, go to chrome://settings/search and ensure your preferred search engine is selected. Finally, check chrome://settings/onStartup to confirm your desired startup page.
For Mozilla Firefox: Type about:addons into your address bar and press Enter. Click on 'Extensions' in the left-hand menu. Look for any unfamiliar extensions, click the three-dot menu next to them, and choose Remove. Then, open about:preferences#search to verify your default search engine and about:preferences#home to set your homepage.

Tip

If an extension won't remove, or keeps reappearing, you might need to check for a malicious program running on your system.

Sometimes, a browser hijacker is part of a larger malicious program. On Linux, you can use built-in tools and reputable third-party software.

Update your system: Open a terminal (Ctrl+Alt+T) and run sudo apt update && sudo apt upgrade (for Debian/Ubuntu-based systems) or sudo dnf update (for Fedora/RHEL-based systems). This ensures you have the latest security patches.
Check for suspicious processes: In the terminal, run top or htop to see running processes. Look for anything unfamiliar that's consuming a lot of resources. You can search online if you're unsure about a process.
Install an antivirus (optional but recommended): While Linux is generally more secure, an antivirus like ClamAV can add an extra layer of protection. Install it with sudo apt install clamav clamav-daemon or sudo dnf install clamav clamav-update. Then, update its definitions with sudo freshclam and scan your home directory with clamscan -r ~/.

Important

Be cautious when downloading and installing software from unofficial sources, as this can introduce more vulnerabilities.

Prevention is better than cure. Here are some ongoing habits to keep your browsers safe from future hijacking attempts:

Only install browser extensions from official stores (Chrome Web Store, Firefox Add-ons).
Be wary of clicking suspicious links or downloading attachments from unknown senders.
Keep your operating system and browsers updated to the latest versions.
Use a reputable ad-blocker to prevent malicious pop-ups.
Consider using a firewall like UFW (Uncomplicated Firewall) to control network traffic: sudo ufw enable.

Tags:

Was this guide helpful?

Know someone who needs this? Send them the guide.

Written by

Founder, CyberSecurityGuides

Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.

Reviewed by CSG Security Engineers