Two Chrome Extensions Caught Secretly Stealing Credentials from Over 170 Sites

Cybersecurity researchers have uncovered two malicious Google Chrome extensions with the same name and publisher that are designed to intercept traffic and steal credentials, marketed as a “multi-location network speed test plug-in” for developers and foreign trade personnel.

The two Phantom Shuttle extensions (ID: fbfldogmkadejddihifklefknmikncaj with 2,000 users, published 26 November 2017, and ID: ocpcmfmiidofonkbodpdhgddhlcmcofd with 180 users, published 27 April 2023) exfiltrate data to the threat actor’s command-and-control server and perform authentication credential injection via a man-in-the-middle proxy.

Users pay subscriptions ranging from ¥9.9 to ¥95.9 CNY (about $1.40 to $13.50 USD) under the guise of a VPN service, while the extensions inject hard-coded proxy credentials (topfany / 963852wei) and route traffic for more than 170 high-value domains through the C2 infrastructure.

According to Socket security researcher Kush Pandya, the extensions enable three proxy modes—close, always, and smarty—while continuously capturing traffic and credentials, including a VIP user’s email and password every five minutes via an HTTP GET beacon. The findings highlight how browser extensions can create persistent data‑theft channels, and users are urged to remove these extensions and enable extension allowlisting and network monitoring.