#PhantomShuttle
~Socket~
Malicious 'Phantom Shuttle' Chrome extensions pose as a VPN to intercept traffic and exfiltrate user credentials via a C2 server.
-
IOCs: phantomshuttle[. ]space, 47[. ]244[. ]125[. ]55
-
#ChromeExtension #Malware #ThreatIntel
Malicious 'Phantom Shuttle' Chrome Extension
socket.dev
December 23, 2025 at 8:04 PM
December 30, 2025 at 6:00 PM
December 26, 2025 at 4:00 PM