Fake VPN Chrome Extensions Harvest User Credentials via Traffic Interception

Two malicious Chrome extensions, 'Phantom Shuttle', masquerade as legitimate VPN services while intercepting user web traffic to steal sensitive login information. Active since 2017, these extensions have been downloaded by over 2,180 users from the Chrome Web Store and continue to operate undetected. The threat actors control proxy servers that reroute user traffic, enabling continuous data capture.