Chrome browser extensions hijacked

Developers of extensions for Google's Chrome web browser are being targeted by an unknown attacker, who has succesfully hacked their accounts and subverted their add-on code for malicious purposes.

After a developer reported that his extension had been compromised, security vendor Proofpoint found evidence that further add-ons in the Chrome Store had also been altered.

The list of compromised extensions so far include:

• Web Developer 0.4.9
• Chrometana 1.1.3
• Infinitely New Tab 3.12.3
• CopyFish 2.8.5
• Web Paint 1.2.1
• Social Fixer 20.1.1

In June, TouchVPN and BetternetVPN were also compromised, Proofpoint researcher Kafeine said.

The attacker obtains access to developer accounts by sending out phishing emails with booby-trapped links that ask the coders to log into their Google Chrome Web Store dashboards.

Once the attacker has access to an account, they add Javascript code to the add-ons to hijack traffic and to substitute advertisements in users' browsers, in order to earn revenue via affiliate programs.

In one instance, the developers of the Copyfish extension fell for the phishing attempt, and didn't discover the compromise for a whole day. 

At this stage, it is not known who is behind the multiple hijackings of Chrome extensions.