Loading malware…
Phantom Shuttle refers to two malicious Google Chrome extensions, active since at least 2017, that masquerade as VPN or network speed testing tools, primarily targeting Chinese-speaking developers and foreign trade workers. Both extensions are published by the same threat actor (theknewone.com@gmail[.]com) and have been distributed via the Chrome Web Store, amassing over 2,180 installations. The extensions lure users into paying for a fake VPN service via Alipay or WeChat Pay, then intercept and redirect web traffic from over 170 high-value domains—including developer platforms (GitHub, Stack Overflow), cloud services (AWS, Azure), enterprise solutions, social media, and adult content sites—through attacker-controlled proxies.
The extensions inject hardcoded proxy credentials (topfany / 963852wei) using obfuscated JavaScript, modify Chrome's proxy settings via PAC scripts, and maintain persistent C2 communication with phantomshuttle[.]space (hosted on Alibaba Cloud, protected by Cloudflare). They exfiltrate sensitive data such as passwords, credit card numbers, authentication cookies, API keys, and browsing history, storing some data in plaintext or weakly hashed form in local storage. Data is sent to the C2 server every five minutes, with a 60-second heartbeat. The extensions' MITM capabilities enable credential theft, session hijacking, and potential payload injection. The targeting of developer and enterprise tools increases the risk of supply chain compromise. The inclusion of adult sites in the target list suggests potential for blackmail or extortion. The operation is well-established, ongoing for over eight years, and leverages a commercial facade to retain victims and generate revenue. Associated MITRE ATT&CK techniques include T1176 (Browser Extensions), T1557 (Adversary-in-the-Middle), and T1539 (Steal Web Session Cookie).
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Phantom Shuttle is a malicious Chrome extension that masquerades as a VPN, intercepting user traffic and exfiltrating credentials.
Phantom Shuttle is a malicious Chrome extension posing as a VPN and network speed testing tool. It intercepts all HTTP authentication requests, injects hardcoded proxy credentials, and redirects user traffic through attacker-controlled proxy servers, enabling man-in-the-middle attacks and credential theft. It exfiltrates user credentials and other sensitive data to a C2 server at regular intervals.
Phantom Shuttle is a malicious Chrome extension that poses as a proxy service tool but covertly routes user web traffic through attacker-controlled proxies, enabling man-in-the-middle attacks to steal credentials, session cookies, API tokens, and other sensitive data. It targets users in China and has been active since at least 2017.
Phantom Shuttle is a malicious Chrome extension masquerading as a VPN or network speed test tool. It intercepts user traffic, injects proxy credentials, routes traffic through attacker-controlled proxies, and exfiltrates sensitive data including credentials, cookies, and developer secrets to a C2 server. It operates as a man-in-the-middle, enabling real-time data theft and potential supply chain attacks.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.