Malicious 'Free VPN' Chrome and Firefox Extensions (VPN Go) Deploy Clipboard-Stealing Malware via Trojanized Updates — Threadlinqs Intelligence
As of 2026-07-10, Malicious 'Free VPN' Chrome and Firefox Extensions (VPN Go) Deploy Clipboard-Stealing Malware via Trojanized Updates is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-1198 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Socket.dev researchers discovered that "VPN Go: Free VPN" (Chrome, 146 users) and "Free VPN by VPN GO" (Firefox, 3,499 users) shipped legitimate proxy functionality for months before malicious updates
Beginning December 22, 2025, a developer using the alias "zegivati83" (zegivati83@gmail.com) published "VPN Go: Free VPN" to the Chrome Web Store and a companion "Free VPN by VPN GO" (internal manifest name "VPN Go", Gecko ID vpngo@vpngo.com) to Mozilla Add-ons. Both extensions functioned purely as free proxy/VPN tools through their initial release versions, building a trusted user base of 146 (Chrome) and 3,499 (Firefox) installs.
The threat actor weaponized the extensions through ordinary-looking auto-updates rather than at initial publication, evading store review scrutiny that typically focuses on submission time. Chrome version 1.1 (published May 31, 2026) added the clipboardRead permission and a content script (scripts/version.js) injected into every visited page (host permissions <all_urls>), polling navigator.clipboard.readText() every 500ms and deduplicating against the last-seen value to avoid redundant exfiltration. A background script (scripts/background.js) handled the runtime messaging and outbound HTTP delivery. Firefox's malicious functionality first appeared in version 1.3.3, consolidated into a single background script polling at a slower 1.5-second interval.
Stolen clipboard text is split into ~1,000-character chunks (exact size randomized via 1000 + Math.floor(19 * Math.random()) to reduce pattern-matching signature reliability), tagged with a base36 timestamp-derived session identifier (uid), and sent as HTTP GET requests using fetch() with mode: 'no-cors' — a technique that suppresses CORS errors in the browser console and lets the request fire-and-forget without the extension needing to read a response, minimizing forensic footprint in dev tools. Query parameters carry uid (session), part (chunk index), total (chunk count), and data (the stolen text fragment) to a PHP receiver at /html/continue.php on attacker infrastructure, authenticated with a static bearer token embedded in the extension code. The same infrastructure also served the extension's proxy backend (/locations endpoint), giving the operators a legitimate-looking dual-purpose C2 channel that blends malicious exfiltration traffic with expected VPN proxy traffic.
Infrastructure rotated at least twice: Chrome v1.1-1.2 and Firefox v1.3.3 used 178.236.252.133 (Firefox on a distinct but adjacent host, 178.236.252.161); Chrome v1.3 and Firefox v1.3.4 migrated in tandem to 77.91.123.187 on June 14, 2026, indicating shared operational control and synchronized infrastructure management across both browser variants. Code-level obfuscation included meaningless variable names, escaped property-access strings, arithmetic-derived constants (e.g., deriving an IP octet via 154 / 2 = 77), and URL fragment reassembly from split string components — techniques intended to defeat static string-matching detection by store reviewers and security scanners.
Because clipboard contents routinely include passwords, MFA/TOTP codes, API keys, OAuth tokens, cloud credentials, cryptocurrency wallet addresses, and seed/recovery phrases, this campaign represents a high-value, low-noise credential and secrets harvesting operation disguised as a privacy tool. The extensions' own privacy policy — hosted on Telegraph (telegra.ph/Privacy-Policy-12-11-127) under contact info@vpngogmail.com — explicitly claimed the product "does not collect, store, or process any personal data," directly contradicted by the implemented clipboard theft, indicating premeditated deception rather than accidental telemetry overreach. Socket reported both extensions to Google and Mozilla; both listings have been pulled from their respective stores as of disclosure.
Weaknesses (CWE)
CWE-506, CWE-359, CWE-311
Target sectors: all sectors general consumer enterprise browser users
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1195, T1189, T1204, T1059.007, T1176.001, T1027, T1036, T1176.001, T1115, T1005