Chrome and Firefox Extensions Posing as Free VPNs Add Clipboard Stealers via Malicious Updates

Malicious browser extensions distributed through Chrome Web Store and Firefox Add-ons marketplaces posed as free VPN services while secretly stealing clipboard data. The Chrome extension, with 146 users, and Firefox extension, with 3,499 users, initially functioned as proxy tools but later incorporated clipboard theft through staged updates. Chrome versions 1.1 onwards and Firefox version 1.3.3 onwards continuously monitored clipboard contents every 500-1500 milliseconds, capturing passwords, API keys, cryptocurrency addresses, and authentication tokens. Stolen data was chunked, tagged with session identifiers, and exfiltrated via HTTP to attacker-controlled infrastructure at multiple IP addresses. Both extensions shared code patterns, infrastructure, and exfiltration endpoints despite appearing as separate products, indicating coordinated malicious operations behind legitimate-appearing privacy tools.

• Black October for AI Developer PlatformsCampaign2026-10-31
• Beware of Phishing Email Disguised as Quotation Inquiry (SnakeKeylogger)Malware2026-11-12
• Citrus Ransomware: tactics, techniques, procedures, and links to Toy GhoulsMalware2026-11-11
• Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 ImplantMalware2026-11-09
• Infostealer VOLTA That Has AI Assess Stolen InformationMalware2026-11-09