Chrometana Chrome extension shipped malware

Chrometana was one of the legitimate Chrome extensions affected by the 2017 developer-account phishing spree. Attackers used stolen Chrome Web Store credentials to publish a malicious update through the official extension channel.

The affected release was Chrometana 1.1.3. Users did not install a fake extension; Chrome's automatic update path delivered a new build from the real listing after the developer account had been taken over.

Proofpoint grouped Chrometana with the broader campaign that loaded attacker JavaScript from shared infrastructure, injected ads, redirected traffic, and in some paths collected credentials. The extension name was different, but the delivery shape matched the other hijacked listings.

This leaf record preserves the extension-specific version and Chrome Web Store boundary. The campaign record carries the shared phishing domains, redirect infrastructure, and cross-extension behavior.