Two Chrome Extensions Caught Secretly Stealing Credentials from Over 170 Sites
Two malicious Google Chrome extensions with the same name and uploaded by the same developer have been found by cybersecurity researchers. These extensions have the ability to intercept communications and obtain user passwords.
The extensions are marketed as a "multi-location network speed test plug-in" for foreign trade staff and developers. As of this writing, you can download both browser add-ons. The extensions' specifics are as follows:
Phantom Shuttle (ID: fbfldogmkadejddihifklefknmikncaj) - 2,000 users (Published on November 26, 2017)
Phantom Shuttle (ID: ocpcmfmiidofonkbodpdhgddhlcmcofd) - 180 users (Published on April 27, 2023)
According to Socket security researcher Kush Pandya, users pay subscriptions ranging from ¥9.9 to ¥95.9 CNY ($1.40 to $13.50 USD), thinking ...