Loading story…
Two Chrome extensions named "Phantom Shuttle" have been discovered masquerading as legitimate VPN or network speed testing tools while secretly intercepting user web traffic and exfiltrating sensitive credentials. Distributed through the Chrome Web Store since at least 2017, these extensions have deceived over 2,180 users, primarily targeting developers and foreign trade workers, by offering paid subscriptions and functional proxy services that create a false sense of legitimacy. The threat actor behind the scheme, using the email theknewone.com@gmail[.]com, published both variants, which operate identically despite different appearances.
The extensions employ a sophisticated credential injection mechanism, automatically inserting hardcoded proxy credentials (username: topfany, password: 963852wei) into every HTTP authentication request, thereby redirecting all browsing traffic through attacker-controlled proxy servers. This enables a persistent man-in-the-middle attack, with all user activity and credentials continuously exfiltrated to a command-and-control server at phantomshuttle[.]space. The malicious code is hidden within modified JavaScript libraries, specifically a tampered jquery-1.12.2.min.js, and the extensions maintain regular communication with the C2 server. Despite takedown requests, the extensions remain active on the Chrome Web Store as of late December 2025.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
As of BleepingComputer's reporting, the malicious Phantom Shuttle extensions were still accessible in the Chrome Web Store despite public disclosure and outreach to Google.
After identifying the malicious behavior, Socket submitted takedown requests to Google seeking removal of the Phantom Shuttle extensions from the Chrome Web Store.
Socket's Threat Research Team identified that the two Chrome extensions were intercepting traffic for more than 170 high-value domains, injecting hardcoded proxy credentials, and exfiltrating credentials and session data to attacker-controlled infrastructure. The research also tied the operation to long-running infrastructure, Chinese payment integrations, and more than 2,180 installs.
A second malicious Phantom Shuttle extension was published in 2023, expanding the same credential-theft and man-in-the-middle operation under the guise of a legitimate proxy or VPN service.
One of the malicious Phantom Shuttle Chrome extensions was available on the Chrome Web Store by at least 2017, posing as a VPN, proxy, or network testing tool while routing user traffic through attacker-controlled infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcethehackernews.com
Open sourcesocket.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported a surge in **malicious Chrome extensions** abusing high-privilege browser permissions to steal credentials and hijack authenticated sessions. LayerX identified at least **16 ChatGPT-related extensions** that mimic legitimate productivity tools and brands, then inject scripts into `chatgpt.com` to monitor outbound web requests and **exfiltrate authorization details and session tokens** to attacker-controlled infrastructure. With stolen tokens, attackers can impersonate victims’ ChatGPT sessions and potentially access connected data sources (e.g., integrations with *Slack* and *GitHub*), expanding impact beyond the AI service itself. Separately, Varonis documented a **malware-as-a-service** browser-extension toolkit dubbed **Stanley** being sold on Russian-language cybercrime forums, marketed to enable large-scale credential theft by **showing a phishing site while the URL bar continues to display the legitimate domain**. The toolkit uses a web-based control panel to configure per-victim “source” (legitimate) and “target” (phishing) URLs, then overlays a full-screen iframe to spoof the destination site; the seller also claims “guaranteed” placement in the **Chrome Web Store**, increasing the likelihood of user installation and enterprise exposure.
Jun 29, 2026
Researchers uncovered a large Chrome Web Store campaign in which **737 browser extensions** posing as free VPN and proxy tools redirected user traffic through attacker-controlled **SOCKS5** infrastructure. The extensions were tied to at least **40 developer accounts** and had accumulated more than **75,000 installs**, with many lures targeting Russian-speaking users seeking access to blocked or restricted online services. Investigators found that numerous listings impersonated legitimate VPN and privacy brands to gain trust. The malicious extensions exposed users to surveillance by allowing operators to observe browsing destinations, connection metadata, source IP addresses, and potentially unencrypted HTTP traffic while victims believed their sessions were protected. Researchers also reported the use of encrypted DNS and remote configuration to hide or rapidly change backend infrastructure, and said some advertised premium servers or features did not function as claimed. Google had removed **221** of the identified extensions at the time of reporting, but **516** remained available, underscoring the scale and persistence of the campaign.
Aug 13, 2026
Multiple **malicious Chrome/Chromium extensions** were identified abusing the Chrome Web Store to steal data from users and enterprises. Two previously legitimate extensions—**QuickLens** (`kdenlnncndfnhkognokgfpabgkgehodd`) and **ShotBird** (`gengfhhkjekmlejbhmmopegofnoifnjp`)—reportedly turned malicious after **ownership transfers**, enabling downstream compromise through injected code and data harvesting. In the QuickLens case, researchers reported the malicious update preserved expected functionality while adding capabilities to **strip security headers** (e.g., `X-Frame-Options`) and facilitate script injection that can bypass **Content Security Policy (CSP)** protections, expanding the attacker’s ability to make cross-domain requests and collect sensitive information. Separately, Microsoft reported a campaign of **counterfeit “AI assistant” browser extensions** distributed via the Chrome Web Store (and therefore also impacting Microsoft Edge environments that allow Chrome extensions), which allegedly affected **20,000+ enterprise tenants** and amassed roughly **900,000 installs**. These extensions impersonated legitimate AI productivity tools and harvested **ChatGPT/DeepSeek conversation histories**, visited URLs, and browsing telemetry, staging data for exfiltration to attacker-controlled infrastructure. Another Chrome Web Store threat involved a fake **imToken**-branded extension (“lmΤoken Chromophore”) that masqueraded as a benign tool but redirected victims to phishing infrastructure to steal **seed phrases and private keys**, using tactics like hardcoded remote configuration (via JSONKeeper) and decoy navigation to the legitimate `token.im` site after credential capture.
Jun 29, 2026