Campaign Proprietary 2017-07-28 · 18 days ·Adware, Ad Fraud

Chrome extension accounts shipped malware

Phishing stole Chrome Web Store developer credentials and pushed malicious extension updates. The campaign injected ads, redirected traffic, and collected credentials.

Story

In 2017, a threat actor phished Chrome extension developers by impersonating the Chrome Web Store team. The lure sent maintainers to fake Google login pages, giving attackers the credentials needed to publish new versions of legitimate extensions through the normal Chrome Web Store update channel.

Copyfish and Web Developer were the first visible cases, but Proofpoint tied the spree to a broader set that included Chrometana, Infinity New Tab, Web Paint, and Social Fixer, and believed TouchVPN and Betternet VPN were hit the same way. BleepingComputer counted nearly 4.8 million installs across the eight extensions, while the six modeled leaf records here track the cases with public version evidence.

The payload was built for patience and reach. Proofpoint and Cloudflare both described a ten-minute delay after install or update, then a request for ga.js from a DGA-generated .win domain such as wd7bdb20e4d622f6569f3e8503138c859d.win. The loader could call second-stage scripts for ad replacement, fake repair popups, affiliate redirects, and Cloudflare credential harvesting from the victim's browser.

The ad-fraud work was not generic spray. The substituted banners covered 33 common ad sizes and focused heavily on adult sites and known ad networks, while the traffic redirection infrastructure overlapped with older fake browser-update and cookie-consent campaigns. The campaign shows why extension stores are software supply chains: a maintainer account is a release key, and once it is stolen the attacker can ship code through the same automatic update path users already trust.

Linked Attacks

2017

Top vector Distribution Top payload point Distribution
6 entries 0 open source 6 proprietary
July 6 entries

Campaign Context

Actor
Cybercriminal
Attribution
Group
Cause
Unknown
User Impact
4800000

Affected Packages

Notes

  • This campaign groups separate Chrome Web Store developer-account compromises. Each extension is modeled as its own attack record because each developer account and extension listing was a distinct distribution boundary.
  • TouchVPN and Betternet VPN are included in campaign scope because Proofpoint and Cloudflare named them as likely same-method compromises, but they are not modeled as leaf records because the public sources do not provide the same version-level detail as the six Chrome extension records above.

External References

Source record: proprietary/campaigns/chrome-extension-hijacking-2017/meta.yaml