Chrome and Firefox Extensions Posing as Free VPNs Add Clipboard Stealers via Malicious Updates

MITRE Techniques

• [T1176.001] Software Extensions: Browser Extensions – The threat was delivered through malicious browser add-ons that users installed from official extension stores (‘browser extensions operating under the VPN Go: Free VPN branding’).
• [T1195.002] Supply Chain Compromise: Compromise Software Supply Chain – The extensions were altered through staged malicious updates after appearing legitimate (‘staged malicious-update pattern’).
• [T1204] User Execution – Users had to install and keep using the extension, believing it was a free VPN tool (‘Users routinely copy passwords… A browser extension with clipboard access does not need…’).
• [T1059.007] Command and Scripting Interpreter: JavaScript – The malicious logic was implemented in JavaScript inside extension scripts (‘the script… reads the clipboard… and sends those chunks’).
• [T1115] Clipboard Data – The extensions monitored and stole copied text from the clipboard (‘continuously monitors copied text and exfiltrates it’).
• [T1027] Obfuscated Files or Information – The code used obfuscation and arithmetic/string tricks to hide malicious behavior (‘lightly obfuscated with meaningless variable names, escaped property strings, and arithmetic constants’).
• [T1071.001] Application Layer Protocol: Web Protocols – Exfiltration used HTTP GET requests to web endpoints (‘sends those chunks to hardcoded HTTP endpoints’).
• [T1041] Exfiltration Over C2 Channel – Clipboard data was transmitted to attacker-controlled infrastructure (‘exfiltrating copied data to hardcoded threat actor-controlled infrastructure’).
• [T1036] Masquerading – The extensions pretended to be legitimate VPN tools with privacy-focused messaging (‘present themselves as free VPN tools’ and ‘privacy-focused positioning’).