Two Chrome extensions steal credentials from 170+ sites

Cybersecurity researchers have uncovered two Google Chrome extensions that they say were covertly intercepting web traffic and harvesting user credentials by routing connections through attacker-controlled proxy infrastructure.

The add-ons share the same name — “Phantom Shuttle” — and were published by the same developer, according to findings from Socket’s Threat Research Team.

As of publication, both extensions were still available to download, researchers said.

The two identified listings were:

• Phantom Shuttle (ID: fbfldogmkadejddihifklefknmikncaj) — about 2,000 users, published November 26, 2017
• Phantom Shuttle (ID: ocpcmfmiidofonkbodpdhgddhlcmcofd) — about 180 users, published April 27, 2023

Marketed as a “multi-location network speed test” plug-in aimed at developers and foreign-trade workers, the extensions offered subscription plans ranging from ¥9.9 to ¥95.9 CNY (about $1.40 to $13.50), Socket researcher Kush Pandya said.

Researchers said the paid “VIP” status automatically enabled a “smarty” proxy mode that routed traffic from more than 170 domains through a command-and-control (C2) system.

Socket said the extensions were modified to prepend malicious code to bundled JavaScript files — including jquery-1.12.2.min.js and scripts.js — and to inject hard-coded proxy credentials (topfany / 963852wei) into HTTP authentication challenges using Chrome’s chrome.webRequest.onAuthRequired with asyncBlocking, without prompting the user.

Once authenticated, the extensions configured Chrome’s proxy settings using a Proxy Auto-Configuration (PAC) script and offered three modes: close (disable), always (route all traffic), and smarty (route only selected high-value domains).

The targeted list included developer platforms, cloud services, enterprise vendors, social media, and adult-content sites—something Socket said could be used for blackmail.

Researchers said the extensions maintained a 60-second “heartbeat” to phantomshuttle[.]space and repeatedly transmitted a VIP user’s email and plaintext password, alongside other metadata, roughly every five minutes for ongoing exfiltration and session monitoring.

Socket said the operation appeared linked to China, citing Chinese-language descriptions, Alipay/WeChat Pay integration and infrastructure hosted on Alibaba Cloud.