{"id":6281,"date":"2025-08-20T10:04:25","date_gmt":"2025-08-20T10:04:25","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/08\/20\/legitimate-chrome-vpn-with-100000-installs-silently-captures-screenshots-and-exfiltrate-sensitive-data\/"},"modified":"2025-08-20T10:04:25","modified_gmt":"2025-08-20T10:04:25","slug":"legitimate-chrome-vpn-with-100000-installs-silently-captures-screenshots-and-exfiltrate-sensitive-data","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/08\/20\/legitimate-chrome-vpn-with-100000-installs-silently-captures-screenshots-and-exfiltrate-sensitive-data\/","title":{"rendered":"Legitimate Chrome VPN With 100,000+ Installs Silently Captures Screenshots and Exfiltrate Sensitive Data"},"content":{"rendered":"

Legitimate Chrome VPN With 100,000+ Installs Silently Captures Screenshots and Exfiltrate Sensitive Data
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A Chrome VPN extension with over 100,000 installations and verified badge status has been discovered operating as sophisticated spyware, continuously capturing user screenshots and exfiltrating sensitive data without consent.<\/p>\n

The extension, known as FreeVPN.One, masqueraded as a legitimate privacy tool while secretly implementing comprehensive surveillance capabilities that directly contradict its stated privacy promises.<\/p>\n

\n
\"\"
FreeVPN.One\u200a\u2014\u200afeatured, verified, and spyware (Source \u2013 Koi.Security)<\/figcaption><\/figure>\n<\/div>\n

The malicious extension gained prominence through Google\u2019s Chrome Web Store, achieving featured placement and verified status despite implementing backdoor functionality that captures screenshots of every webpage users visit.<\/p>\n

Operating under the guise of providing privacy protection, the extension employs a deceptive two-stage architecture that silently monitors user activity across all browsing sessions, capturing sensitive information including banking credentials, personal communications, and private documents.<\/p>\n

\n
\"\"
Private pictures sent to the spyware\u2019s backend (Source \u2013 Koi.Security)<\/figcaption><\/figure>\n<\/div>\n

Koi.Security analysts noted<\/a> that the extension\u2019s evolution from legitimate VPN service to spyware occurred through a series of calculated updates beginning in April 2025, when developers introduced broad permissions that enabled comprehensive data collection capabilities.<\/p>\n

\n
\"\"
DevTools showing captured Google Sheets tab with sensitive data (Source \u2013 Koi.Security)<\/figcaption><\/figure>\n<\/div>\n

Security researchers identified the transformation as particularly concerning, given the extension\u2019s verified status and widespread adoption among privacy-conscious users.<\/p>\n

The surveillance<\/a> campaign impacts users globally, with captured screenshots containing sensitive corporate data, financial information, and personal communications being transmitted to remote servers controlled by the threat actors.<\/p>\n

The extension\u2019s privileged position within users\u2019 browsers enables unrestricted access to all browsing activity, creating a comprehensive intelligence-gathering operation that operates entirely without user knowledge or consent.<\/p>\n

Technical Implementation and Evasion Mechanisms<\/strong><\/h2>\n

The extension implements its surveillance capabilities through a sophisticated content script injection system that automatically deploys across all HTTP and HTTPS websites using the broad matches: [\"http:\/\/*\/*\", \"https:\/\/*\/*\"]<\/code> pattern.<\/p>\n

Upon page load initialization, the malicious code executes a precisely timed delay mechanism:-<\/p>\n

setTimeout(() => {\n    chrome.runtime.sendMessage({action: 'captureViewport'});\n}, 1100);<\/code><\/pre>\n
This code waits exactly 1.1 seconds after page initialization before triggering screenshot capture, ensuring complete page rendering for maximum data quality.<\/p>\n
\n
\"\"
\u2018Scan with AI\u2019 click redirect to aitd[.]one site (Source \u2013 Koi.Security)<\/figcaption><\/figure>\n<\/div>\n
The background service worker receives the captureViewport message and executes actual screenshot capture using Chrome\u2019s privileged chrome.tabs.captureVisibleTab()<\/code> API, automatically transmitting captured images to aitd[.]one\/brange.php<\/code> alongside page URLs, tab identifiers, and unique user tracking codes.<\/p>\n
Recent versions implement AES-256-GCM encryption with RSA key wrapping to obfuscate<\/a> data transmission, making network-based detection significantly more challenging.<\/p>\n
The encryption layer masks the continuous screenshot exfiltration while maintaining the extension\u2019s surveillance capabilities, demonstrating the threat actors\u2019 commitment to persistence<\/a> and detection evasion.<\/p>\n
The extension\u2019s permission structure requires <all_urls><\/code>, tabs<\/code>, and scripting<\/code> permissions, creating a comprehensive surveillance framework that extends far beyond legitimate VPN<\/a> functionality requirements and enables complete user activity monitoring.<\/p>\n
Boost\u00a0your\u00a0SOC and help your team protect your business with free top-notch threat intelligence:\u00a0Request TI Lookup Premium Trial<\/a>.<\/code><\/strong><\/p>\n
The post Legitimate Chrome VPN With 100,000+ Installs Silently Captures Screenshots and Exfiltrate Sensitive Data<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n
 \t

\n 
<\/BR>
\n    Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n 
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"
Legitimate Chrome VPN With 100,000+ Installs Silently Captures Screenshots and Exfiltrate Sensitive Data A Chrome VPN extension with over 100,000 installations and verified badge status has been discovered operating as sophisticated spyware, continuously capturing user screenshots and exfiltrating sensitive data without consent. The extension, known as FreeVPN.One, masqueraded as a legitimate privacy tool while secretly […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-6281","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/6281"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=6281"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/6281\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=6281"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=6281"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=6281"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}