Loading story…
Researchers have uncovered that the Universe Browser, advertised as a privacy-focused web browser and downloaded millions of times, covertly routes all user traffic through servers in China and installs hidden programs that run silently in the background. These hidden features include keylogging, surreptitious connections, and manipulation of network settings, raising significant concerns about user privacy and security. The browser is directly linked to Southeast Asian cybercrime networks, particularly those involved in illegal online gambling, money laundering, and scam operations that exploit forced labor.
Investigations by Infoblox, in collaboration with the United Nations Office on Drugs and Crime, have traced the browser's distribution to a major iGaming software supplier servicing criminal groups in Cambodia and beyond. The operation, associated with the threat group dubbed Vault Viper, demonstrates the increasing sophistication of cybercriminals in the region, who are leveraging seemingly legitimate software to facilitate large-scale fraud, surveillance, and other illicit activities under the guise of privacy and censorship circumvention.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
The published research detailed that Universe Browser routes traffic through servers in China, disables security features, installs hidden components, and includes capabilities such as keylogging, screenshot capture, and persistent background activity. Researchers said the browser and related infrastructure were built for exploitation, surveillance, and monetization rather than legitimate privacy protection.
Researchers from Infoblox, working with the United Nations Office on Drugs and Crime, published findings tying the Universe Browser to BBIN (Baoying Group) and the Vault Viper threat infrastructure. They assessed the browser as a malware-like tool distributed through gambling sites and linked to Southeast Asia's cybercrime ecosystem.
US authorities recently seized $15 billion in Bitcoin from a Cambodian scam organization linked to BBIN, highlighting the scale of the criminal ecosystem surrounding the group. The seizure is referenced as a major law-enforcement action connected to the broader network.
In 2024, the Philippines banned offshore gaming operators, a move that researchers say pushed related gambling and cybercrime operations further underground rather than stopping them. The ban is cited as an important backdrop to the continued activity of BBIN-linked infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 53 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
arstechnica.com
Open sourcewired.com
Open sourceblogs.infoblox.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Investigations found that several popular Chrome and Edge extensions collected sensitive user data at scale, including AI chat conversations and browsing activity, often with limited transparency. Reports said extensions such as **Urban VPN**, Stylish, Poper Blocker, SimilarWeb, StayFocusd, CrxMouse, WhatRuns, and StayFree had either directly exfiltrated AI chat content or retained the remote-configurable capability to do so, affecting more than 7 million installs combined; a separate report alleged Urban VPN-related "privacy" extensions monetized data from roughly 8 million users. Researchers also reported that Urban VPN had previously scraped AI conversations and that its user-facing **opt-out of data collection** control was inverted in code, potentially leaving collection enabled even when users believed they had disabled it. Urban VPN was also found to contain a high-severity browser-extension flaw that let any website send privileged `postMessage` commands without origin validation, allowing attackers to disconnect the VPN, reroute traffic, change bypass settings, disable privacy protections, disable competing extensions, and query extension state. The issue was reportedly fixed in **Urban VPN version 5.12.5** by limiting accepted messages to a read-only query, while broader concerns about data collection practices remained. Together, the findings raised concerns that widely installed browser extensions marketed around convenience or privacy could both harvest sensitive content and expose users to direct manipulation of browser security controls.
Aug 21, 2026
The Urban VPN Proxy Chrome extension, boasting over 6 million installs and a "Featured" badge on the Chrome Web Store, was discovered secretly collecting and exfiltrating user conversations with major AI chatbots, including ChatGPT, Claude, Gemini, Microsoft Copilot, Perplexity, DeepSeek, Grok, and Meta AI. Researchers found that a silent update in July 2025 (version 5.5.0) introduced hidden code that intercepts every prompt and response exchanged with these AI platforms, along with conversation identifiers, timestamps, and session metadata. The extension, which markets itself as a privacy and security tool, continued to harvest data regardless of whether the VPN service was active, betraying user trust and bypassing normal browser security boundaries. Captured data was sent to Urban VPN’s servers and subsequently sold to marketing analytics firms, notably BiScience, a known data broker. The malicious behavior was enabled by script injection that overrode browser APIs such as `fetch()` and `XMLHttpRequest()`, ensuring all relevant traffic was intercepted. The extension’s widespread distribution and high user ratings, combined with its presence on both Chrome and Edge marketplaces, amplified the impact of this breach. The incident highlights the risks posed by browser extensions with privileged access and the potential for abuse even among highly rated and officially endorsed add-ons.
Jun 29, 2026
**Jewelbug**—also tracked as **Earth Alux**, `REF7707`, and `CL-STA-0049`—has been identified as a China-based hackers-for-hire group running state-aligned espionage campaigns alongside a large-scale cryptocurrency fraud operation from the same infrastructure. Researchers said the group targeted government ministries, militaries, police, and government email accounts across the Middle East, Southeast Asia, and South Asia, including a campaign that compromised a shared government webmail platform and turned it into a watering hole affecting more than 15 government tenants. The operation relied on the browser-focused **XG-Web** remote-access and information-stealing platform, the **Antino** Windows backdoor, a malicious **"PDF Viewer"** browser extension, and the **ClientKing** Linux/router implant. Investigators reported that the victim database logged more than **1 million implant check-ins**, over **580,000 stolen browser cookies**, thousands of credentials, and thousands of exfiltrated email bodies in under three months. The same operators also ran SEO-poisoning and fake exchange-download campaigns impersonating **OKX** and **Binance** to target Chinese-speaking cryptocurrency users, and the commercial side of the activity was linked to a registered company in **Hunan, China**, suggesting the fraud operation may have supplied access, delivery, or support for the espionage campaigns.
Aug 17, 2026