Developers of extensions for Google's Chrome web browser are being targeted by an unknown attacker, who has succesfully hacked their accounts and subverted their add-on code for malicious purposes.
The list of compromised extensions so far include:
- Web Developer 0.4.9
- Chrometana 1.1.3
- Infinitely New Tab 3.12.3
- CopyFish 2.8.5
- Web Paint 1.2.1
- Social Fixer 20.1.1
In June, TouchVPN and BetternetVPN were also compromised, Proofpoint researcher Kafeine said.
The attacker obtains access to developer accounts by sending out phishing emails with booby-trapped links that ask the coders to log into their Google Chrome Web Store dashboards.
In one instance, the developers of the Copyfish extension fell for the phishing attempt, and didn't discover the compromise for a whole day.
At this stage, it is not known who is behind the multiple hijackings of Chrome extensions.