30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One
Researchers found 737 Chrome VPN extensions, many impersonating brands like NordVPN, routing roughly 75,000 users' browser traffic through attacker-controlled SOCKS5 proxies.
Socket and researcher Kush Pandya identified 737 Chrome VPN and proxy extensions, published across at least 40 developer accounts with 75,486 installs, that route entire browser sessions through one provider's SOCKS5 proxies on port 1082. Of these, 274 impersonate 66 established brands including Proton VPN, NordVPN, Surfshark, ExpressVPN, and Cloudflare 1.1.1.1. The proxy bypass list only excludes loopback addresses, exposing visited destinations, source IPs, TLS SNI values, and plain-HTTP request bodies to the operator. 221 extensions have been removed from the Chrome Web Store while 516 remain listed as active.
60
30
30
30
30
30
Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users
Malicious Twitch extension 'Twitch Enhanced Viewer | JeetBot' leaked OAuth tokens from nearly 31,000 users to Russian bot-service proxy servers.
Socket researchers found the 'Twitch Enhanced Viewer | JeetBot' browser extension forwarded users' live Twitch OAuth tokens as an &auth= query parameter to operator-controlled proxy servers, affecting about 30,000 Chrome users and 604 Firefox users. The tokens, written in cleartext to proxy logs, are bearer credentials granting access to chat, whispers, and account settings without password or 2FA. The operator is a Russian commercial Twitch/Kick/VK-Live bot SaaS linked to Cyprus-based developer Aleksandr Popov; earlier v4.x builds also POSTed tokens to a set-token endpoint. Firefox add-on version 85.8.7 stops the token forwarding, but previously transmitted tokens remain valid until revoked.
50
30
30
30
30
30
JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies
Check Point details JSCeal, a V8-compiled JavaScript stealer that replays stolen cookies to bypass Google authentication, spread via crypto malvertising.
Check Point Research's new report analyzes JSCeal, a compiled V8 JavaScript malware obfuscated with javascript-obfuscator using RC4-protected strings, control-flow flattening, and proxy functions. Delivered through fake TradingView installers on malvertising sites overlapping the WEEVILPROXY/MeadowLocust and SourTrade campaigns, it harvests cookies, passwords and OAuth tokens from Chromium browsers, records keystrokes and screenshots, and can replay stolen Google session cookies to bypass authentication. It also installs a local proxy with service-specific handlers for Binance, Bybit, and Ledger to intercept and modify cryptocurrency-related traffic.
45
30
30
30
40 Malicious Firefox Extensions Pose as Web3 Products to Steal Wallet Secrets
Socket found 40 malicious Firefox extensions impersonating OKX, Rabby Wallet, and TronLink to steal cryptocurrency wallet recovery phrases and private keys.
The Socket Threat Research team identified 40 malicious Firefox extensions masquerading as Web3 products including OKX, Rabby Wallet, and TronLink, part of a broader set of 77 add-ons sharing source code and infrastructure overlaps. The campaign, dubbed Offside Wallet Theft Factory, has been active since March 2026 and remains unattributed. Of the 40 confirmed malicious extensions, 15 capture recovery phrases and private keys exfiltrated through Cloudflare Workers, 13 modified Rabby Wallet builds exfiltrate serialized keyrings before local encryption, seven use attacker-controlled Supabase projects as remote switches, and five capture credentials and clipboard data via hard-coded C2. Some extensions began as sports score or utility shells before being repurposed into wallet stealers under the same Firefox ID.
58
30
30
30