Malware
js.wd
The threat actor of this family compromised Chrome extension developer accounts and attached malicious code to the extensions.
js.wd is a JavaScript malware family.
Background
Operators behind this family took over the developer accounts of several Chrome extensions and injected malicious code into them. Affected extensions included Web Developer 0.4.9, Chrometana 1.1.3, Infinity New Tab 3.12.3, CopyFish 2.8.5, Web Paint 1.2.1, and Social Fixer 20.1.1, with TouchVPN and BetterVPN also believed to be among the targets.
The injected code triggered a secondary JavaScript that swapped legitimate ad banners with the attackers' own, redirecting advertising revenue to them. Reports also indicate that bogus pop-up warnings were used to trick victims into downloading additional malware.
Source: Malpedia (Fraunhofer FKIE).