Socket: Chrome and Firefox VPN Extensions Add Clipboard Stealers via Malicious Updates

What it is

Two malicious "VPN Go: Free VPN" browser extensions (Chrome Web Store and Firefox Add-ons, listed under "Free VPN by VPN GO"), analyzed by Socket's Threat Research Team. Both are functional proxy extensions that added a clipboard stealer via staged updates. The Chrome listing showed 146 users at version 1.3 (updated June 14, 2026), offered by zegivati83 (zegivati83@gmail[.]com); the Firefox listing showed 3,499 users. Both have been reported to Google and Mozilla for removal.

How it works

The malicious update adds clipboardRead permission and a content script injected into <all_urls> at run_at: document_start — so it runs on every page early in the lifecycle, independent of the user ever clicking "connect." The script reads clipboard contents on a timer (roughly every half second), splits copied text into chunks, generates session identifiers, and POSTs the data over plain HTTP to .../html/continue.php on hardcoded threat-actor IPs. The code is described as lightly obfuscated. Targets are the high-value secrets users routinely copy: passwords, MFA codes, API keys, OAuth tokens, and crypto seed phrases/wallet addresses.

Preconditions / Affected

Users with either extension installed at a malicious version. The clipboard theft is not present in early versions and appears at specific update boundaries:

timeline
    Chrome 1.0 (Dec 22 2025) : benign proxy
    Chrome 1.1 - 1.2 : clipboard theft to 178.236.252.133
    Chrome 1.3 : clipboard theft moved to 77.91.123.187
    Firefox 1.1 - 1.3.2 : benign proxy
    Firefox 1.3.3 : clipboard theft to 178.236.252.161
    Firefox 1.3.4 : clipboard theft moved to 77.91.123.187

What to do

• Remove the extensions and treat any secrets copied while installed as compromised (rotate passwords, API keys, tokens; move crypto funds if wallet material was on the clipboard).
• Block/hunt for these exfil endpoints (defanged as published):
• hxxp://178[.]236[.]252[.]133/html/continue[.]php (Chrome 1.1–1.2)
• hxxp://77[.]91[.]123[.]187/html/continue[.]php (Chrome 1.3, Firefox 1.3.4)
• hxxp://178[.]236[.]252[.]161/html/continue[.]php (Firefox 1.3.3)
• Detection heuristic for review: a "VPN"/proxy extension requesting clipboardRead plus a content script on <all_urls> at document_start is a red flag — a legitimate VPN needs proxy/network/storage permissions but has no reason to read the clipboard.
• Note the privacy policy is hosted on Telegraph (telegra[.]ph/Privacy-Policy-12-11-127, contact info@vpngogmail[.]com) and falsely claims no data collection — treat off-domain Telegraph policies as a signal.

Caveats

The write-up is limited to the versions Socket analyzed; other versions are not confirmed either way. The 178.236.252.161 Firefox IP is a distinct indicator not in the catalog summary. At time of writing the extensions were still live pending vendor action.