December 23.2025
2 Minutes Read

How Two Chrome Extensions Steal Credentials from Over 170 Sites

Chrome logo with security icons, highlighting malicious Chrome extensions stealing user credentials.

Danger from Within: Chrome Extensions as a Security Threat

Recent findings have uncovered a significant security breach involving two malicious Google Chrome extensions, both masquerading under the name Phantom Shuttle. Deceptively marketed as tools for network speed testing, these extensions have been successfully operating since at least 2017, ensnaring unsuspecting users into a web of cybercrime. With subscriptions ranging from $1.40 to $13.50, victims believe they are purchasing legitimate VPN services, when in reality, they are enabling a platform for data theft.

The Mechanics of Malicious Operations

Both versions of Phantom Shuttle enact a sophisticated operation, intercepting user credentials by manipulating web traffic. The extension executes a serious breach by injecting hard-coded proxy credentials into HTTP authentication prompts without users’ knowledge. This is done using pre-existing JavaScript libraries, such as jquery-1.12.2.min.js, coupled with a web traffic listener that seamlessly reroutes the browser’s proxy settings to allow the threat actors to act as man-in-the-middle proxies.

Target Profile of Victims

It appears the targeted demographic for these extensions primarily includes developers and foreign trade personnel in China. The extensions have also included high-value sites in their routing list, from social networks like Facebook and Instagram to developer platforms like GitHub, effectively capturing a vast array of sensitive data, including session cookies, credit card numbers, and personal information.

Potential Risks and Repercussions

Researchers at Socket have pointed out that this malicious dual-extension tactic creates not only a threat for individual users but also represents a significant risk for corporate environments. Those who fall victim to this deceptive product may unknowingly expose sensitive corporate information, paving the way for supply chain attacks that could have larger implications.

What You Can Do

Cybersecurity experts urge users to be vigilant. They recommend uninstalling suspicious extensions immediately and advocating for tighter controls on browser extensions, such as implementing allowlisting and real-time monitoring for malicious behavior. Moreover, users are advised to carefully verify extension permissions and only download from credible developers.

Cybersecurity Corner

2 Views

0 Comments

Write A Comment

*
*
Related Posts All Posts
03.01.2026

How the ClawJacked Flaw Could Compromise Your AI Systems

Update Understanding the ClawJacked Vulnerability and Its Implications A significant security flaw recently came to light, codenamed ClawJacked. This vulnerability within the OpenClaw AI framework demonstrated how malicious websites could potentially hijack local AI agents through the WebSocket protocol. When a developer unknowingly visits a compromised site, JavaScript embedded on that page can exploit a strength in the system's architecture by connecting to the OpenClaw gateway running on the local machine. With this access, attackers can manipulate AI agents extensively, posing grave risks to information integrity and security. The Attack Mechanism: What You Need to Know Here’s how the attack unfolds: First, the rogue JavaScript initiates a connection with localhost, targeting the OpenClaw gateway. Once connected, it takes advantage of weak security measures—specifically, the absence of rate limits on password attempts—to brute-force the gateway’s password. If successful, the script obtains admin-level permissions without any user awareness, allowing for a plethora of malicious activities, from accessing configuration data to executing unauthorized commands. Such vulnerabilities reveal a misplaced trust in local devices, a recurrent theme in cybersecurity threats. Broader Security Context The ClawJacked vulnerability surfaces amid heightened scrutiny of AI systems like OpenClaw, especially as these platforms are designed for integration with multiple enterprise tools. Lack of robust security measures increases the risk of cascading failures across interconnected systems, a concern reiterated by various cybersecurity reports. A recent study highlighted that instances of OpenClaw left exposed to the Internet create an expanded attack surface, increasing the potential damage from any successful compromise. Mitigation and Recommendations In response, OpenClaw has acted swiftly, rolling out a critical patch to address the ClawJacked issue within 24 hours of discovery. Users of OpenClaw are advised to regularly update their installations and review access controls for AI agents diligently. It’s essential to implement tight governance around any non-human identities to prevent attacks that exploit lax security frameworks. Conclusion: Staying Vigilant in the Age of AI The emergence of vulnerabilities like ClawJacked not only underscores the need for stronger security protocols in AI technologies but also highlights an essential shift in cybersecurity approaches. As more businesses adopt AI systems integrated with existing workflows, understanding and addressing these vulnerabilities is crucial for maintaining system security and trust.

03.01.2026

Ransomware Threatens Healthcare: Lessons from HBO's The Pitt

Update Ransomware in Healthcare: A Rising Threat As of late February 2026, the world of healthcare has been rocked by an alarming surge in ransomware attacks, with recent incidents propelling the issue into the public spotlight. HBO's The Pitt features a dramatic account of a ransomware attack on a fictional trauma center, ingeniously mirroring the real-life attack on the University of Mississippi Medical Center (UMMC) on the same day. This coincidence between fiction and reality underlines a growing concern in healthcare cybersecurity. The Realities of Cyberattacks According to experts, today's healthcare facilities are increasingly dependent on IT systems. When these systems are compromised, the fallout is not just operational but directly impacts patient care, resulting in deferred treatments and compromised patient safety. Ross Filipek, chief information security officer at Corsica Technologies, articulates the chaos of losing digital charting and tracking systems, observing how efficiency plummets rapidly. On a practical level, hospitals need to not only recover from cyber incidents but also prioritize patient safety amid system failures. Ryan Witt, from Proofpoint, emphasizes that healthcare facilities must prepare for operational disruptions by developing concrete, actionable downtime plans. These plans should ensure that medication management, patient triage, and care prioritization remain robust, even when IT systems are not operational. Why The Pitt Strikes a Chord The show highlights a real challenge faced by healthcare organizations: balancing the need to secure IT with the immediate demands of patient care. The portrayal of staff resorting to manual processes—using ballpoint pens and paper—resonates with professionals in the industry. Detailed elements, such as the mention of carbon copy paper, reveal an understanding of hospital operations that few dramatizations capture. However, while The Pitt makes significant strides in portraying the chaos of cyberattacks, critiques remain about certain exaggerated scenarios, such as patient monitors continuing to function during a major system outage. This discrepancy serves to remind viewers—and healthcare professionals alike—that while dramas capture the essence of a crisis, they can occasionally oversimplify the complexities involved. Preparing for Cyber Incidents The show wraps up with the hospital staff still grappling with the aftermath of the cyberattack, which serves as a wake-up call for real-life healthcare institutions. The narrative challenges organizations to rethink their approach to cybersecurity, not just viewing it as an IT issue but a patient safety priority. As more hospital executives begin to recognize the interdependence of cyber health and patient care, a shift in strategy is imperative. Ultimately, as the threats evolve, so must the responses; hospitals need to enhance their cybersecurity measures, ensuring that they remain resilient in the face of potential attacks. This means not only investing in technology but also fostering a culture that regularly emphasizes training and preparedness against cyber threats. The events of UMMC and the dramatization in The Pitt signal not only a pressing concern but also an opportunity for healthcare facilities to adapt and strengthen their stance against the rising tide of ransomware. The convergence of these two narratives prompts a re-evaluation of safety protocols and operational strategies, an essential task that cannot be sidelined in the rapidly advancing digital age.

02.27.2026

Trojanized Gaming Tools: A New Threat of Java-Based RATs Unleashed

Update Threat Actors Exploit Gaming Tools for Remote AccessIn a growing trend within cyber threats, malicious entities are employing trojanized gaming tools to deploy a remote access trojan (RAT) via popular browsers and chat platforms. This tactic is particularly insidious as it relies on social engineering to deceive unsuspecting gamers into downloading corrupted software.How the Attack UnfoldsAccording to the Microsoft Threat Intelligence team, the attack starts with a stealthy downloader that sets up a portable Java runtime environment and executes a malicious Java Archive (JAR) file named jd-gui.jar. Utilizing well-known native system binaries, such as PowerShell and cmstp.exe, the malware avoids detection while executing its malicious tasks.What makes these RATs particularly concerning is their multi-functional nature. They can carry out operations such as file management, credential theft, and providing live surveillance—all under the radar of typical security defenses. The commands from the remote server can pivot the malware to exfiltrate user data or install additional payloads on compromised devices.Defensive Strategies Against RATsWith incidents like these on the rise, users and organizations need proactive measures to fortify their cybersecurity. Recommendations include auditing Microsoft Defender exclusions and scheduled tasks, as well as removing any malicious scripts, such as the notorious world.vbs, which aids in maintaining persistence of the attack.The Emergence of New RAT FamiliesThe landscape of remote access trojans is evolving, with newly identified malware families like Steaelite and others being advertised in underground forums as effective means for double extortion, consolidating ransomware capabilities alongside data theft into a single control panel.Final Insights: Stay VigilantIn light of these threats, it is crucial for users to be aware of the sources from which they download software and to maintain updated security practices to effectively guard against these evolving cyber threats. By fostering vigilance and updating defenses, potential risks can be mitigated.

Terms of Service

Privacy Policy

Core Modal Title

Sorry, no results found

You Might Find These Articles Interesting

T
Please Check Your Email
We Will Be Following Up Shortly
*
*
*