Two Chrome Extensions Caught Secretly Stealing Credentials from Over 170 Websites

Cybersecurity researchers have found two malicious Google Chrome extensions with the identical title and revealed by the identical developer that include capabilities to intercept visitors and seize consumer credentials.

The extensions are marketed as a “multi-location community pace take a look at plug-in” for builders and overseas commerce personnel. Each the browser add-ons can be found for obtain as of writing. The small print of the extensions are as follows –

• Phantom Shuttle (ID: fbfldogmkadejddihifklefknmikncaj) – 2,000 customers (Printed on November 26, 2017)
• Phantom Shuttle (ID: ocpcmfmiidofonkbodpdhgddhlcmcofd) – 180 customers (Printed on April 27, 2023)

“Customers pay subscriptions starting from ¥9.9 to ¥95.9 CNY ($1.40 to $13.50 USD), believing they’re buying a respectable VPN service, however each variants carry out an identical malicious operations,” Socket safety researcher Kush Pandya mentioned.

“Behind the subscription facade, the extensions execute full visitors interception via authentication credential injection, function as man-in-the-middle proxies, and repeatedly exfiltrate consumer information to the risk actor’s C2 [command-and-control] server.”

As soon as unsuspecting customers make the fee, they obtain VIP standing and the extensions auto-enable “smarty” proxy mode, which routes visitors from over 170 focused domains via the C2 infrastructure.

The extensions work as marketed to bolster the phantasm of a purposeful product. They carry out precise latency exams on proxy servers and show connection standing, whereas preserving customers at nighttime about their fundamental purpose, which is to intercept community visitors and steal credentials.

This entails malicious modifications prepended to 2 JavaScript libraries, specifically, jquery-1.12.2.min.js and scripts.js, that come bundled with the extensions. The code is designed to mechanically inject hard-coded proxy credentials (topfany / 963852wei) into each HTTP authentication problem throughout all web sites by registering a listener on chrome.webRequest.onAuthRequired.

“When any web site or service requests HTTP authentication (Primary Auth, Digest Auth, or proxy authentication), this listener fires earlier than the browser shows a credential immediate,” Pandya defined. “It instantly responds with the hardcoded proxy credentials, utterly clear to the consumer. The asyncBlocking mode ensures synchronous credential injection, stopping any consumer interplay.”

As soon as customers authenticate to a proxy server, the extension configures Chrome’s proxy settings utilizing a Proxy Auto-Configuration (PAC) script to implement three modes –

• shut, which disables the proxy function
• all the time, which routes all internet visitors via the proxy
• smarty, which routes a hard-coded checklist of greater than 170 high-value domains via the proxy

The checklist of domains consists of developer platforms (GitHub, Stack Overflow, Docker), cloud companies (Amazon Net Companies, Digital Ocean, Microsoft Azure), enterprise options (Cisco, IBM, VMware), social media (Fb, Instagram, Twitter), and grownup content material websites. The inclusion of pornographic websites is probably going an try to blackmail victims, Socket theorized.

The online results of this habits is that consumer internet visitors is routed via risk actor-controlled proxies whereas the extension maintains a 60-second heartbeat to its C2 server at phantomshuttle[.]area, a website that continues to be operational. It additionally grants the attacker a “man-in-the-middle” (MitM) place to seize visitors, manipulate responses, and inject arbitrary payloads.

Extra importantly, the heartbeat message transmits a VIP consumer’s e-mail, password in plaintext, and model quantity to an exterior server by way of an HTTP GET request each 5 minutes for steady credential exfiltration and session monitoring.

“The mix of heartbeat exfiltration (credentials and metadata) plus proxy MitM (real-time visitors seize) offers complete information theft capabilities working repeatedly whereas the extension stays energetic,” Socket mentioned.

Put in a different way, the extension captures passwords, bank card numbers, authentication cookies, looking historical past, type information, API keys, and entry tokens from customers accessing the focused domains whereas VIP mode is energetic. What’s extra, the theft of developer secrets and techniques might pave the way in which for provide chain assaults.

It is at the moment not identified who’s behind the eight-year-old operation, however using Chinese language language within the extension description, the presence of Alipay/WeChat Pay integration to make funds, and using Alibaba Cloud to host the C2 area factors to a China-based operation.

“The subscription mannequin creates sufferer retention whereas producing income, and the skilled infrastructure with fee integration presents a facade of legitimacy,” Socket mentioned. “Customers consider they’re buying a VPN service whereas unknowingly enabling full visitors compromise.”

The findings spotlight how browser-based extensions have gotten an unmanaged threat layer for enterprises. Customers who’ve put in the extensions are suggested to take away them as quickly as potential. For safety groups, it is important to deploy extension allowlisting, monitor for extensions with subscription fee programs mixed with proxy permissions, and implement community monitoring for suspicious proxy authentication makes an attempt.