# Malicious 'Free VPN' Chrome and Firefox Extensions (VPN Go) Deploy Clipboard-Stealing Malware via Trojanized Updates

> Socket.dev researchers discovered that "VPN Go: Free VPN" (Chrome, 146 users) and "Free VPN by VPN GO" (Firefox, 3,499 users) shipped legitimate proxy functionality for months before malicious updates added clipboard-monitoring code that chunks and exfiltrates copied text via HTTP GET requests to attacker-controlled servers. Both extensions were reported to Google and Mozilla and have since been removed.

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-07-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1198
- **ID:** TL-2026-1198
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Beginning December 22, 2025, a developer using the alias "zegivati83" (zegivati83@gmail.com) published "VPN Go: Free VPN" to the Chrome Web Store and a companion "Free VPN by VPN GO" (internal manifest name "VPN Go", Gecko ID vpngo@vpngo.com) to Mozilla Add-ons. Both extensions functioned purely as free proxy/VPN tools through their initial release versions, building a trusted user base of 146 (Chrome) and 3,499 (Firefox) installs.

The threat actor weaponized the extensions through ordinary-looking auto-updates rather than at initial publication, evading store review scrutiny that typically focuses on submission time. Chrome version 1.1 (published May 31, 2026) added the clipboardRead permission and a content script (scripts/version.js) injected into every visited page (host permissions <all_urls>), polling navigator.clipboard.readText() every 500ms and deduplicating against the last-seen value to avoid redundant exfiltration. A background script (scripts/background.js) handled the runtime messaging and outbound HTTP delivery. Firefox's malicious functionality first appeared in version 1.3.3, consolidated into a single background script polling at a slower 1.5-second interval.

Stolen clipboard text is split into ~1,000-character chunks (exact size randomized via 1000 + Math.floor(19 * Math.random()) to reduce pattern-matching signature reliability), tagged with a base36 timestamp-derived session identifier (uid), and sent as HTTP GET requests using fetch() with mode: 'no-cors' — a technique that suppresses CORS errors in the browser console and lets the request fire-and-forget without the extension needing to read a response, minimizing forensic footprint in dev tools. Query parameters carry uid (session), part (chunk index), total (chunk count), and data (the stolen text fragment) to a PHP receiver at /html/continue.php on attacker infrastructure, authenticated with a static bearer token embedded in the extension code. The same infrastructure also served the extension's proxy backend (/locations endpoint), giving the operators a legitimate-looking dual-purpose C2 channel that blends malicious exfiltration traffic with expected VPN proxy traffic.

Infrastructure rotated at least twice: Chrome v1.1-1.2 and Firefox v1.3.3 used 178.236.252.133 (Firefox on a distinct but adjacent host, 178.236.252.161); Chrome v1.3 and Firefox v1.3.4 migrated in tandem to 77.91.123.187 on June 14, 2026, indicating shared operational control and synchronized infrastructure management across both browser variants. Code-level obfuscation included meaningless variable names, escaped property-access strings, arithmetic-derived constants (e.g., deriving an IP octet via 154 / 2 = 77), and URL fragment reassembly from split string components — techniques intended to defeat static string-matching detection by store reviewers and security scanners.

Because clipboard contents routinely include passwords, MFA/TOTP codes, API keys, OAuth tokens, cloud credentials, cryptocurrency wallet addresses, and seed/recovery phrases, this campaign represents a high-value, low-noise credential and secrets harvesting operation disguised as a privacy tool. The extensions' own privacy policy — hosted on Telegraph (telegra.ph/Privacy-Policy-12-11-127) under contact info@vpngogmail.com — explicitly claimed the product "does not collect, store, or process any personal data," directly contradicted by the implemented clipboard theft, indicating premeditated deception rather than accidental telemetry overreach. Socket reported both extensions to Google and Mozilla; both listings have been pulled from their respective stores as of disclosure.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1189 Drive-by Compromise
- T1204 User Execution
- T1059.007 JavaScript
- T1176.001 Browser Extensions
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1115 Clipboard Data
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1571 Non-Standard Port
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1552 Unsecured Credentials
- T1119 Automated Collection
- T1518 Software Discovery

## Sources

- [Chrome and Firefox extensions for free VPNs add clipboard stealers](https://socket.dev/blog/chrome-and-firefox-extensions-free-vpns-add-clipboard-stealers?utm_medium=feed)
- [Chrome and Firefox Free VPN extensions caught stealing clipboard data](https://cyberinsider.com/chrome-and-firefox-vpn-extensions-caught-stealing-clipboard-data/)
- [That free VPN Chrome and Firefox extension may be reading your clipboard every half a second, researchers warn](https://www.techradar.com/vpn/vpn-privacy-security/that-free-vpn-chrome-and-firefox-extension-may-be-reading-your-clipboard-every-half-a-second-researchers-warn)
- [Chrome and Firefox Extensions Posing as Free VPNs Add Clipboard Stealers via Malicious Updates](https://www.hendryadrian.com/chrome-and-firefox-extensions-posing-as-free-vpns-add-clipboard-stealers-via-malicious-updates/)
- [Malicious Chrome Extensions as VPN Intercept User Traffic to Steal Credentials](https://cybersecuritynews.com/malicious-chrome-extensions-as-vpn/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1198