Loading story…
Researchers uncovered multiple browser-extension campaigns that abused clipboard access to steal sensitive data and cryptocurrency. Socket found that Chrome and Firefox extensions branded as VPN Go: Free VPN initially behaved like legitimate proxy tools before later updates added clipboard monitoring, data chunking, session tagging, and HTTP exfiltration to hardcoded attacker-controlled IP addresses. The Chrome extension turned malicious in version 1.1, while the Firefox add-on first did so in version 1.3.3, indicating a staged update strategy designed to retain users while covert theft ran in parallel.
A separate campaign tracked as Silent Swap used unsigned installers to deploy a fake Google Notes Chromium extension that replaced copied wallet addresses with attacker-controlled ones, enabling cryptocurrency theft across multiple coins. McAfee said the malware modified Chromium preference files and recalculated integrity values to avoid detection, while using EtherHiding and blockchain-based dead-drop resolution to fetch command-and-control details; the activity also overlaps with CountLoader, suggesting a shared operator. Google and Mozilla were notified about the malicious VPN-themed extensions, and users who copied passwords, wallet addresses, or other secrets while the add-ons were installed are advised to treat that data as compromised.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
McAfee said Silent Swap overlaps with earlier CountLoader activity, suggesting the same threat actor, and noted the campaign uses EtherHiding for blockchain-based dead drop resolution of command-and-control details.
McAfee described an active campaign dubbed Silent Swap that uses unsigned installers to deploy a malicious Chromium extension disguised as "Google Notes" to replace copied cryptocurrency wallet addresses with attacker-controlled ones.
Socket said it reported the malicious VPN Go Chrome and Firefox extensions to Google and Mozilla for review and removal after identifying clipboard-stealing and exfiltration behavior.
Socket reported that the Firefox add-on branded as "VPN Go: Free VPN" first became malicious in version 1.3.3, adding clipboard theft capabilities while retaining visible VPN functionality as cover.
Socket found that the Chrome extension branded as "VPN Go: Free VPN" shifted from proxy behavior to malicious behavior when version 1.1 introduced clipboard monitoring and exfiltration logic.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple **malicious browser extension** campaigns abusing official add-on ecosystems to steal data and hijack accounts. One operation tracked as **GhostPoster** hid malicious logic inside seemingly benign PNG image files, a technique used to evade typical extension review and static checks; follow-on infrastructure analysis linked the activity to at least **17 additional extensions** using the same backend and tactics, with **~840,000 installs** and some extensions active for up to **five years**. The campaign reportedly started on **Microsoft Edge** and later expanded to **Chrome and Firefox**, emphasizing stealth and long-term persistence over rapid spread. Separately, Socket researchers identified **five malicious Chrome extensions** impersonating enterprise platforms (*Workday, NetSuite, SuccessFactors*) to enable **session hijacking and account takeover**. The extensions were described as working together to **steal authentication tokens/cookies**, **block incident response** by manipulating the DOM to interfere with security administration pages, and perform **cookie injection** to take over sessions; most were removed from the Chrome Web Store but remained available via third-party download sites. In response to the broader extension abuse, **Mozilla and Microsoft** removed identified add-ons from their marketplaces, but already-installed extensions remain a risk and require **manual removal**.
Jun 29, 2026
Researchers reported an active **Silent Swap** campaign that distributes a fake **"Google Notes"** browser extension to steal cryptocurrency by replacing copied wallet addresses with attacker-controlled ones during transactions. The operation uses unsigned **.NET** and **Golang** installers to silently sideload the malicious extension into Chromium-based browsers including **Chrome, Edge, Brave, and Opera**, where it monitors clipboard activity and browser input for wallet strings across multiple blockchains and swaps them in real time. The malware reportedly abuses Chromium trust mechanisms by altering **Secure Preferences** and related settings files, recalculating integrity values so the extension appears legitimately installed without user approval. Researchers said the campaign also uses **EtherHiding**-style blockchain-based command-and-control, querying a smart contract through public RPC infrastructure to resolve active C2 domains such as `devops-offensive[.]cc` and `Zebregts[.]com`, complicating detection and takedown. The activity has been linked to the **CountLoader** threat actor, with infections observed globally and a heavier concentration in **India**, while dynamic per-victim wallet mapping and published hashes, domains, payload URLs, and Bitcoin wallet indicators suggest a broad effort to monetize consumer cryptocurrency transactions.
Jul 2, 2026
Security researchers reported a surge in **malicious Chrome extensions** abusing high-privilege browser permissions to steal credentials and hijack authenticated sessions. LayerX identified at least **16 ChatGPT-related extensions** that mimic legitimate productivity tools and brands, then inject scripts into `chatgpt.com` to monitor outbound web requests and **exfiltrate authorization details and session tokens** to attacker-controlled infrastructure. With stolen tokens, attackers can impersonate victims’ ChatGPT sessions and potentially access connected data sources (e.g., integrations with *Slack* and *GitHub*), expanding impact beyond the AI service itself. Separately, Varonis documented a **malware-as-a-service** browser-extension toolkit dubbed **Stanley** being sold on Russian-language cybercrime forums, marketed to enable large-scale credential theft by **showing a phishing site while the URL bar continues to display the legitimate domain**. The toolkit uses a web-based control panel to configure per-victim “source” (legitimate) and “target” (phishing) URLs, then overlays a full-screen iframe to spoof the destination site; the seller also claims “guaranteed” placement in the **Chrome Web Store**, increasing the likelihood of user installation and enterprise exposure.
Jun 29, 2026