Copyfish Chrome extension shipped malware

Copyfish was one of the legitimate Chrome extensions affected by the 2017 developer-account phishing spree. Attackers used stolen Chrome Web Store credentials to publish a malicious update through the official extension channel.

The affected release was Copyfish 2.8.5. The compromise was especially visible because the extension was already trusted by users for optical character recognition workflows, so the malicious update arrived as routine browser maintenance rather than as a new install decision.

The malicious extension activity sat inside the same Proofpoint-tracked campaign as Chrometana, Web Developer, Infinity New Tab, Web Paint, and Social Fixer. The common pattern was stolen publisher access followed by ad injection, traffic redirection, and credential-theft-capable JavaScript.

This leaf record preserves the Copyfish version and Chrome Web Store distribution boundary. The campaign record carries the shared phishing domains, redirect infrastructure, and cross-extension behavior.