Bleepingcomputer

Malicious Chrome Extensions Steal User Data for Years

First seen 6 Jan 2026, 20:46 UTC • Bleepingcomputer

•69% similarity •27.3

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Two malicious Chrome extensions, disguised as proxy tools, have been stealing sensitive user data since at least 2017. Named 'Phantom Shuttle', these extensions have been active in the Chrome Web Store and primarily target users in China, including foreign trade workers. Security researchers discovered that the extensions hijack user traffic to access credentials and other sensitive information.

ThreatCluster AI How this analysis works

Attack Flow

12 entities, 19 inferred relationships (STIX 2.1).

Threat Actor (2)

DarkSpectre
ShadyPanda

Technique (2)

Malware
Man-in-the-Middle

Campaign (1)

Zoom Stealer

Indicator (1)

socket.dev

Malware (2)

GhostPoster
Phantom Shuttle

Affected Platform (3)

Edge
Firefox
Windows

Tool (1)

Chrome

Relationships

DarkSpectre uses GhostPoster
DarkSpectre uses Phantom Shuttle
ShadyPanda uses GhostPoster
ShadyPanda uses Phantom Shuttle
DarkSpectre uses Chrome
ShadyPanda uses Chrome
DarkSpectre uses Malware
DarkSpectre uses Man-in-the-Middle
ShadyPanda uses Malware
ShadyPanda uses Man-in-the-Middle
GhostPoster communicates with socket.dev
Phantom Shuttle communicates with socket.dev
Zoom Stealer attributed to DarkSpectre
Zoom Stealer attributed to ShadyPanda
Zoom Stealer uses GhostPoster
Zoom Stealer uses Phantom Shuttle
DarkSpectre related to Edge
DarkSpectre related to Firefox
DarkSpectre related to Windows

Community

Browse all →

Tracked Entities in This Story

DarkSpectre ShadyPanda GhostPoster Phantom Shuttle Zoom Stealer Edge Firefox Windows

Malicious Chrome Extensions Steal User Data for Years

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story