A new security threat to Chrome users is coming to light with the malicious “Phantom Shuttle” extensions , which appear to be legitimate VPN services but actually monitor online activity and steal credentials . This scam has quietly spread to thousands of users, exploiting trust in popular browser extensions.
Since 2017, over 2,180 users have installed these extensions via the Chrome Web Store, without suspecting their malicious nature. Their creator uses the email theknewone.com@gmail.com to publish both variants, which, despite their different appearance, perform the same malicious function.
A false sense of security
Phantom Shuttle is presented as a network speed testing tool and is aimed at developers or users in China. Users pay subscriptions ranging from 9.9 to 95.9 yuan (US$1.4 to 13.5) via Alipay or WeChat Pay , and receive seemingly functional proxy services that perform real latency tests and display connection status.
See also: Chrome extension lets AI intercept user conversations
This security “face” hides the real activity behind the scenes. As Socket.dev analysts found , the extensions intercept all of a user’s web traffic via a credential injection mechanism . They insert hardcoded proxy credentials (username: topfany, password: 963852wei), without any knowledge or consent of the victims. In this way, attackers can redirect browsing traffic through their own servers, essentially creating a man-in-the-middle attack .
Technical analysis and interception mechanism
Phantom Shuttle uses modified JavaScript libraries, such as jquery-1.12.2.min.js and scripts.js, hiding the malicious code through a custom character-index encoding scheme. This makes it significantly more difficult to detect during security analysis.
The code registers a listener in chrome.webRequest.onAuthRequiredthat intercepts each authentication request and automatically responds with the encoded credentials, using the asyncBlocking. This way, the interception is done synchronously and invisibly to the user.
The extension maintains a 60-second heartbeat on the C2 server (phantomshuttle.space), continuously extracting user data. Every five minutes, email addresses and passwords are sent in plain text, creating serious risks for identity theft and fraud.
See also: Malicious Chrome extension introduces hidden SOL fees into Solana transactions
User implications and safety guidelines
Socket.dev has already submitted removal requests for the extensions to the Chrome Web Store security team. Experts recommend that users who have installed these extensions uninstall them immediately and change all passwords they have used in their browsers.
Phantom Shuttle is a stark reminder that even seemingly legitimate extensions can harbor malicious activity. Users should carefully verify the credibility of extensions, examine comments, reviews, and developer origins, and prefer VPN tools from trusted, official sources.
The battle for safe browsing continues
The Phantom Shuttle case highlights the growing threat posed by malicious Chrome extensions and third-party tools. As users increasingly rely on browser-based services and VPNs for their daily communication and work, the need for heightened vigilance and awareness is more urgent than ever.
See also: Malicious Prettier extension in VSCode Marketplace distributes Anivia Stealer
Protecting personal data and credentials is no longer an optional issue; it is a basic requirement for security in the modern digital environment. Phantom Shuttle is a classic example of how a well-crafted false facade can hide devastating consequences for unwary users.
🔑 Secure your passwords with Proton Pass
Password manager from Proton — end-to-end encryption, passkeys, built-in 2FA, and monitoring for leaks of your credentials.
- ✔ Encrypted storage of passwords & passkeys
- ✔ Notification if any of your passwords are leaked (Dark Web Monitoring)
- ✔ Free version — on all devices
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
