Loading story…
Attackers compromised several legitimate Chrome extensions by phishing developers’ Google Account credentials and then using those accounts to push malicious updates through the Chrome Web Store. Proofpoint reported that affected extensions included Web Developer (0.4.9), Chrometana, Infinity New Tab, CopyFish, Web Paint, and Social Fixer, with TouchVPN and Betternet VPN also likely impacted. Because the updates came from trusted publisher accounts, the malicious code was delivered to existing users as if it were a normal extension release.
The injected code delayed execution after installation, retrieved additional payloads from DGA-generated domains, and then manipulated browser activity to hijack traffic, replace advertisements, display fake repair alerts, and redirect victims to affiliate programs. Researchers also identified credential-theft components in the campaign, including scripts intended to steal and exfiltrate Cloudflare credentials, showing that the operation combined ad fraud, traffic interception, and account compromise in a broad extension hijacking spree.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
The report ties the broader campaign to earlier fake Chrome extension and cookie-consent abuse that had been documented in July 2016, indicating related infrastructure and tactics predated the 2017 hijackings.
Proofpoint disclosed that multiple legitimate Chrome extensions, including Web Developer, Chrometana, Infinity New Tab, CopyFish, Web Paint, and Social Fixer, were compromised after attackers phished developers' Google account credentials and pushed malicious updates.
Chris Pederick reported that his Web Developer for Chrome extension had been compromised, confirming that attackers had inserted malicious code into the legitimate package.
On August 3, the compromised Web Developer extension requested ga.js from a second DGA-generated domain, wd8a2b7d68f1c7c7f34381dc1a198465b4[.]win, continuing the malicious update activity.
On August 2, the malicious Web Developer 0.4.9 extension fetched ga.js over HTTPS from the DGA-generated domain wd7bdb20e4d622f6569f3e8503138c859d[.]win as part of its staged payload delivery.
Proofpoint states that TouchVPN and Betternet VPN were also likely compromised using the same phishing-and-malicious-update method at the end of June.
During the Infinity New Tab compromise, victims were shown fake repair alerts and malicious code that Proofpoint later described as almost identical to the code used in subsequent extension hijackings, though with a slightly different DGA.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 60 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple **malicious Chrome/Chromium extensions** were identified abusing the Chrome Web Store to steal data from users and enterprises. Two previously legitimate extensions—**QuickLens** (`kdenlnncndfnhkognokgfpabgkgehodd`) and **ShotBird** (`gengfhhkjekmlejbhmmopegofnoifnjp`)—reportedly turned malicious after **ownership transfers**, enabling downstream compromise through injected code and data harvesting. In the QuickLens case, researchers reported the malicious update preserved expected functionality while adding capabilities to **strip security headers** (e.g., `X-Frame-Options`) and facilitate script injection that can bypass **Content Security Policy (CSP)** protections, expanding the attacker’s ability to make cross-domain requests and collect sensitive information. Separately, Microsoft reported a campaign of **counterfeit “AI assistant” browser extensions** distributed via the Chrome Web Store (and therefore also impacting Microsoft Edge environments that allow Chrome extensions), which allegedly affected **20,000+ enterprise tenants** and amassed roughly **900,000 installs**. These extensions impersonated legitimate AI productivity tools and harvested **ChatGPT/DeepSeek conversation histories**, visited URLs, and browsing telemetry, staging data for exfiltration to attacker-controlled infrastructure. Another Chrome Web Store threat involved a fake **imToken**-branded extension (“lmΤoken Chromophore”) that masqueraded as a benign tool but redirected victims to phishing infrastructure to steal **seed phrases and private keys**, using tactics like hardcoded remote configuration (via JSONKeeper) and decoy navigation to the legitimate `token.im` site after credential capture.
Jun 29, 2026
Researchers uncovered a large Chrome Web Store campaign in which **737 browser extensions** posing as free VPN and proxy tools redirected user traffic through attacker-controlled **SOCKS5** infrastructure. The extensions were tied to at least **40 developer accounts** and had accumulated more than **75,000 installs**, with many lures targeting Russian-speaking users seeking access to blocked or restricted online services. Investigators found that numerous listings impersonated legitimate VPN and privacy brands to gain trust. The malicious extensions exposed users to surveillance by allowing operators to observe browsing destinations, connection metadata, source IP addresses, and potentially unencrypted HTTP traffic while victims believed their sessions were protected. Researchers also reported the use of encrypted DNS and remote configuration to hide or rapidly change backend infrastructure, and said some advertised premium servers or features did not function as claimed. Google had removed **221** of the identified extensions at the time of reporting, but **516** remained available, underscoring the scale and persistence of the campaign.
Aug 13, 2026
Security researchers reported a surge in **malicious Chrome extensions** abusing high-privilege browser permissions to steal credentials and hijack authenticated sessions. LayerX identified at least **16 ChatGPT-related extensions** that mimic legitimate productivity tools and brands, then inject scripts into `chatgpt.com` to monitor outbound web requests and **exfiltrate authorization details and session tokens** to attacker-controlled infrastructure. With stolen tokens, attackers can impersonate victims’ ChatGPT sessions and potentially access connected data sources (e.g., integrations with *Slack* and *GitHub*), expanding impact beyond the AI service itself. Separately, Varonis documented a **malware-as-a-service** browser-extension toolkit dubbed **Stanley** being sold on Russian-language cybercrime forums, marketed to enable large-scale credential theft by **showing a phishing site while the URL bar continues to display the legitimate domain**. The toolkit uses a web-based control panel to configure per-victim “source” (legitimate) and “target” (phishing) URLs, then overlays a full-screen iframe to spoof the destination site; the seller also claims “guaranteed” placement in the **Chrome Web Store**, increasing the likelihood of user installation and enterprise exposure.
Jun 29, 2026