Malicious extensions in Chrome Web store steal user credentials

Researchers found two Chrome Web Store extensions called 'Phantom Shuttle' that pose as proxy tools but route user traffic through attacker-controlled proxies (using hardcoded credentials and an obfuscated encoding scheme), intercept HTTP authentication challenges, and can capture credentials, payment details, session cookies and API tokens; the extensions have been active since at least 2017 and target users in China while routing traffic for over 170 high-value domains.