Social Fixer Chrome extension shipped malware

Social Fixer was one of the legitimate Chrome extensions affected by the 2017 developer-account phishing spree. Attackers used stolen Chrome Web Store credentials to publish a malicious update through the official extension channel.

The affected release was Social Fixer 20.1.1. The extension already ran in the browser against social-network pages, so a malicious update could exploit permissions and user trust that had been granted long before the account takeover.

Proofpoint tied Social Fixer to the same extension-hijacking campaign as Copyfish, Web Developer, Chrometana, Infinity New Tab, and Web Paint. The shared pattern was stolen Chrome Web Store publisher access followed by ad injection, redirects, and credential-theft-capable script loading.

This leaf record preserves the Social Fixer version and store distribution boundary. The campaign record carries the shared phishing domains, redirect infrastructure, and cross-extension behavior.