Researchers from Proofpoint published a report that shows more extensions has been hijacked. They do believe TouchVPN and Betternet VPN also compromised. Compromised version of the extension attempts to substitute ads on the victims browser, hijacking traffic from legitimate advertising networks. According to their Proofpoint analysis, the compromised extension will check for the chrome extension for 10 minutes and then it uses to retrieve remote file ga.js over HTTPS secure connection. It’s vague the amount of that activity was created through the hijacked Chrome Extensions.”]
Source: https://gbhackers.com/seven-chrome-extensions-compromised/