Two browser extensions posing as free VPN services—one for Chrome with 146 users and one for Firefox with 3,499 users—were found to perform clipboard data theft through staged updates. Starting from Chrome extension version 1.1 and Firefox extension version 1.3.3, the extensions monitored clipboard contents every 500 to 1500 milliseconds, capturing sensitive information including passwords and authentication tokens. The stolen data was segmented, tagged with session identifiers, and sent via HTTP to multiple attacker-controlled IP addresses. Despite appearing as separate products, both extensions shared code patterns, infrastructure, and exfiltration endpoints, indicating a coordinated malicious campaign. The extensions were distributed through official browser extension marketplaces, exploiting user trust in free VPN services.

Users of these malicious extensions risk exposure of sensitive clipboard data including passwords, API keys, cryptocurrency addresses, and authentication tokens. This data theft can lead to account compromise, financial loss, and unauthorized access to user resources. The extensions' presence in official marketplaces increases the likelihood of unsuspecting users installing them, amplifying the potential impact.

No official patch or remediation is indicated. Users should immediately uninstall these extensions from their browsers. Security teams should review installed browser extensions for suspicious or unknown VPN-related extensions, especially those matching the described versions or names. Avoid installing free VPN extensions from untrusted sources. Monitor for updates from browser extension marketplaces regarding removal or blocking of these malicious extensions. Since these extensions were distributed via official stores, vendors may have taken or will take action to remove them; users should check vendor advisories for updates.