Popular free VPN browser extensions used in malicious campaigns

Rafi Mahmood

Observed in the wild

• On 15 December, Koi identified various free browser extensions, including Urban VPN Proxy, a Chrome extension with over 6 million users, injecting scripts into popular AI chat platforms (ChatGPT, Claude, Gemini, Copilot, and more) to intercept and exfiltrate user conversations.
• On 16 December, Koi uncovered another campaign, dubbed "GhostPoster" and affecting around 50,000 users, in which multiple Firefox extensions use steganography to embed loader malware in its PNG icon. The loader activates 48 hours after installation, fetches payloads from remote servers, and grants backdoor access.
• Both campaigns leverage "Free VPN" extensions as attack vectors, abusing user trust while advertising privacy protection.
• Organisations are advised to enforce strict browser extension policies, block unverified or “free VPN” tools, monitor for script injection and steganographic behaviours, and educate employees on the risks of shadow IT and consumer-grade VPN extensions.

8 Million Users' AI Conversations Sold for Profit by "Privacy" Extensions | Koi Blog
Inside GhostPoster: How a PNG Icon Infected 50,000 Firefox Users | Koi Blog

Du'aine Davis

Update: Continued Growth of the GhostPoster Campaign

Observed in the wild

• The GhostPoster campaign has expanded significantly beyond the initial Firefox‑based discovery. LayerX’s investigation confirms that the operation now spans Chrome, Edge, and Firefox, incorporating 17 known malicious extensions that have collectively reached hundreds of thousands of installations, demonstrating a long‑term, stealth‑focused strategy rather than rapid proliferation.
• Researchers note clear evolution within the campaign: newer variants have shifted their malicious logic into background scripts and now hide payloads in bundled images, not just icons, allowing for deeper dormancy, modularity and improved resistance to static or behavioural analysis. This reflects a maturing threat actor refining its TTPs while maintaining persistence across multiple browser ecosystems.
• Given the campaign’s expansion across browser stores since as early as 2020, combined with multi‑year undetected activity and slow, methodical scaling, it is likely that GhostPoster is not an isolated incident but part of a broader, long‑lived extension‑based malware ecosystem. Its continued activity, even after exposure, highlights the increasing need for strict extension governance and continuous behavioural monitoring within enterprise environments.

Browser Extensions Gone Rogue: The Full Scope of the GhostPoster Campaign - LayerX