Fake VPN Chrome Extensions Steal Credentials by Intercepting User Traffic
Socket's Threat Research Team has identified a sophisticated credential-harvesting campaign using malicious Chrome extensions, active since 2017.
Socket's Threat Research Team has identified a sophisticated credential-harvesting campaign using malicious Chrome extensions, active since 2017.
Extension Details and Malicious Activities
Two versions of an extension named Phantom Shuttle (幻影穿梭) have been identified. These extensions, published under the threat actor email, have compromised over 2,180 users by posing as legitimate network testing tools. They execute complete traffic interception and credential theft.
The extensions claim to be "multi-location network speed testing plugins" targeting Chinese-speaking developers and foreign trade personnel. Users pay monthly subscriptions ranging from ¥9.9 to ¥95.9 CNY ($1.40–$13.50 USD), believing they are purchasing a functional VPN service.
Behind their commercial appearance, both variants perform identical malicious operations, including automatic credential injection into HTTP authentication requests and man-in-the-middle proxy positioning. The malware operates through two malicious JavaScript libraries bundled within the extension, using custom character-index encoding obfuscation.
The malware injects hardcoded proxy credentials (topfany / 963852wei) into every HTTP authentication challenge across all websites. A Chrome webRequest listener intercepts authentication prompts before users see them, responding with threat actor credentials transparently.
Socket's Threat Research Team has identified a sophisticated credential-harvesting campaign using malicious Chrome extensions, active since 2017.
Upon activating VIP status through payment, the extension configures Chrome's Proxy Auto-Configuration (PAC) script to route traffic from over 170 targeted domains through attacker-controlled proxies. The domain list includes developer tools, cloud service consoles, corporate platforms, social media, and adult content sites.
The attacker achieves a complete man-in-the-middle position, capturing HTTP traffic, headers, POST data, form submissions, authentication cookies, and sensitive API tokens in real-time.
The extension maintains a 60-second heartbeat to its C2 server at phantomshuttle.space. Every 5 minutes, it transmits user email addresses and plaintext passwords directly to the threat actor via unencrypted JSON requests.
The operation has been ongoing for over eight years, indicating a well-established campaign. The C2 domain, registered on Fri, Nov 3, 2017, remains active as of Tue, Dec 23, 2025, resolving to IP 47.244.125.55 on Alibaba Cloud in Hong Kong.
The campaign creates significant corporate risk, as compromised credentials from platforms like GitHub and AWS can enable supply chain attacks and unauthorized code injection. Organizations should audit employee-installed extensions, deploy extension allowlisting policies, and block extensions requesting webRequest, authProvider, and proxy permissions simultaneously.
Users are advised to review extension permissions before installation, avoid VPN extensions requesting sensitive permissions, and maintain separate credentials for personal and corporate systems. Takedown requests have been submitted to Google's Chrome Web Store, though the extensions remain live at publication.
Based on reporting by GBHackers.