From Cybersecurity Help – Malicious Phantom Shuttle Chrome extensions hijack user traffic

The extensions route all web traffic through attacker-controlled proxy servers using hardcoded credentials hidden with a custom encoding scheme. 

​ Read More 

​