This threat involves malicious Chrome and Firefox browser extensions posing as free VPN services. After initial benign proxy functionality, staged updates introduced clipboard stealing that continuously monitored clipboard data at intervals between 500 and 1500 milliseconds. The malware collected sensitive information including passwords, API keys, cryptocurrency addresses, and authentication tokens. Data was chunked and tagged with session identifiers before being exfiltrated over HTTP to multiple attacker-controlled IP addresses and domains. Despite appearing as separate products, both extensions shared code patterns and infrastructure, suggesting a coordinated campaign. The Chrome extension had approximately 146 users, and the Firefox extension had about 3,499 users. No CVE or official patch information is provided.

The clipboard stealing functionality exposes users to credential theft and compromise of sensitive information such as passwords, API keys, cryptocurrency addresses, and authentication tokens. This can lead to unauthorized access to user accounts, financial loss, and further compromise of user systems or services. The exfiltration of data to attacker-controlled infrastructure enables persistent data theft without user knowledge. The extensions' presence in official browser marketplaces increases the risk of widespread exposure.

No official patch or remediation guidance is provided in the available data. Users should immediately uninstall these malicious extensions from their browsers. Security teams should monitor for the presence of these extensions (notably Chrome versions 1.1+ and Firefox version 1.3.3+ of the identified extensions) and block associated domains and IP addresses used for data exfiltration. Users should also change any potentially compromised credentials and review accounts for unauthorized activity. Vendors and marketplace operators should be notified to remove these malicious extensions to prevent further distribution. Patch status is not yet confirmed — check vendor advisories and browser marketplace updates for current remediation guidance.