Chrome and Firefox Extensions Posing as Free VPNs Add Clipboard Stealers via Malicious Updates
Malicious VPN extensions for Chrome and Firefox were updated to steal clipboard data.
Malicious browser extensions masquerading as free VPNs, branded 'VPN Go: Free VPN', have been updated to include clipboard-stealing capabilities. These extensions, available on the Chrome Web Store and Mozilla's Firefox Add-ons marketplace, exfiltrate copied data like passwords, API keys, and MFA codes to threat actor-controlled infrastructure. The malicious functionality was introduced through staged updates, with earlier versions acting as legitimate proxy tools before the addition of the clipboard stealer.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThreat actors leveraged the implicit trust users place in browser extension update mechanisms by initially publishing legitimate-appearing VPN tools, then silently introducing clipboard-stealing malware through subsequent updates — a classic staged supply chain attack. This matters because clipboard data routinely contains highly sensitive material including passwords, API keys, cryptocurrency wallet addresses, and MFA codes, all of which were exfiltrated to attacker-controlled infrastructure. The attack exploited the lack of user scrutiny around extension updates, which are typically applied automatically and silently. Browser extension marketplaces, despite vetting processes, remain a viable and underutilized attack surface that bypasses traditional perimeter defenses. Organizations and individuals who install unvetted 'free' productivity tools without ongoing review face persistent credential theft risk.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- ip — 178.236.252.133
- ip — 77.91.123.187
- ip — 178.236.252.161
- url — hxxp://178.236.252.133/html/continue.php
- url — hxxp://77.91.123.187/html/continue.php
- url — hxxp://178.236.252.161/html/continue.php
- url — hxxp://178.236.252.133/locations
- url — hxxp://77.91.123.187/locations
- url — hxxp://178.236.252.161/locations
- hash_sha256 — 43dc5b1d4c73d5ed9f4f7f561830079896eeb533a7c21bc577e4e267d5a3aa56
- hash_sha256 — b3b63970833b3379ecec2d3ef8fea328fef8dd1c1574b1bcdfebad5bdce9280c
- hash_sha256 — 72fc06a8b03720f4a64744eecd5b3f658ad880bdb327c0c465c7bdc66b14a8d2
- hash_sha256 — fbbdf4bc490ad7b28953630c1707aa68b89d319b9b735f3d8563320b81b21a97
- hash_sha256 — 2fe9c41901045013ba28ccb9af5870f9aef4f1ffd1e717cd5e0189ffdbe7fca2
- mitre_attack — T1115
- mitre_attack — T1059.007
- mitre_attack — T1071.001
- mitre_attack — T1041
- mitre_attack — T1036
- mitre_attack — T1176.001
- mitre_attack — T1027