Two Chrome extensions named 'Phantom Shuttle' pose as proxy service plugins to hijack user traffic and steal sensitive data. The extensions have been active since at least 2017 and route all user web traffic through attacker-controlled proxies using hardcoded credentials. The malicious code is prepended to the legitimate jQuery library and uses custom character-index encoding to hide proxy credentials. Extensions dynamically reconfigure Chrome's proxy settings using auto-configuration scripts. In 'smarty' mode, they route over 170 high-value domains through the proxy network including developer platforms, cloud service consoles, social media sites, and adult content portals. Acting as man-in-the-middle, the extensions capture form data, steal session cookies from HTTP headers, and extract API tokens from requests.