Fake “Phantom Shuttle” VPN Chrome extensions (active since 2017) hijack proxy auth to intercept traffic and continuously exfiltrate user credentials to attacker…

Socket researchers identified two malicious Chrome extensions named "Phantom Shuttle" masquerading as VPN services that have been active since 2017. The extensions use subscription models charging users $1.40-$13.50 USD while performing complete traffic interception through hardcoded proxy credentials injection. They automatically inject credentials "topfany/963852wei" into HTTP authentication challenges, route traffic through attacker-controlled proxies, and continuously exfiltrate user data to C2 server phantomshuttle[.]space. The extensions target 170+ high-value domains including developer tools, cloud services, and social media platforms. Over 2,180 users are affected, with continuous credential theft and man-in-the-middle attacks enabling comprehensive data collection including passwords, session tokens, and browsing history.