Web Developer Chrome extension shipped malware

Web Developer was one of the legitimate Chrome extensions affected by the 2017 developer-account phishing spree. Attackers used stolen Chrome Web Store credentials to publish a malicious update through the official extension channel.

The affected release was Web Developer 0.4.9. This was not a typosquat or a cloned listing; the attack used the real Chrome Web Store extension account, so existing users received the hostile build through the normal update mechanism.

The malicious update loaded attacker-controlled JavaScript associated with the broader campaign. Reporting linked the activity to ad substitution, redirect chains, and credential-theft-capable behavior across several hijacked extensions.

This leaf record preserves the Web Developer version and store distribution boundary. The campaign record carries the shared phishing domains, redirect infrastructure, and cross-extension behavior.