This is Lowpass by Janko Roettgers, a newsletter on the ever-evolving intersection of tech and entertainment, syndicated just for The Verge subscribers once a week.
Technology
Malicious Chrome extensions caught stealing sensitive data
NEWYou can now listen to Fox News articles!
Chrome extensions are supposed to make your browser more useful, but they’ve quietly become one of the easiest ways for attackers to spy on what you do online. Security researchers recently uncovered two Chrome extensions that have been doing exactly that for years.
These extensions looked like harmless proxy tools, but behind the scenes, they were hijacking traffic and stealing sensitive data from users who trusted them. What makes this case worse is where these extensions were found. Both were listed on Chrome’s official extension marketplace.
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.
FAKE AI CHAT RESULTS ARE SPREADING DANGEROUS MAC MALWARE
Security researchers uncovered malicious Chrome extensions that quietly routed users’ web traffic through attacker-controlled servers to steal sensitive data. (Gokhan Balci/Anadolu Agency/Getty Images)
Malicious Chrome extensions hiding in plain sight
Researchers at Socket discovered two Chrome extensions using the same name, “Phantom Shuttle,” that were posing as tools for proxy routing and network speed testing (via Bleeping Computer). According to the researchers, the extensions have been active since at least 2017.
Both extensions were published under the same developer name and marketed toward foreign trade workers who need to test internet connectivity from different regions. They were sold as subscription-based tools, with prices ranging from roughly $1.40 to $13.60.
At a glance, everything looked normal. The descriptions matched the functionality. The pricing seemed reasonable. The problem was what the extensions were doing after installation.
How Phantom Shuttle steals your data
Socket researchers say Phantom Shuttle routes all your web traffic through proxy servers controlled by the attacker. Those proxies use hardcoded credentials embedded directly into the extension’s code. To avoid detection, the malicious logic is hidden inside what appears to be a legitimate jQuery library.
The attackers didn’t just leave credentials sitting in plain text. The extensions hide them using a custom character-index encoding scheme. Once active, the extension listens to web traffic and intercepts HTTP authentication challenges on any site you visit.
To make sure traffic always flows through their infrastructure, the extensions dynamically reconfigure Chrome’s proxy settings using an auto-configuration script. This forces your browser to route requests exactly where the attacker wants them.
In its default “smarty” mode, Phantom Shuttle routes traffic from more than 170 high-value domains through its proxy network. That list includes developer platforms, cloud service dashboards, social media sites and adult content portals. Local networks and the attacker’s own command-and-control domain are excluded, likely to avoid breaking things or raising suspicion.
While acting as a man-in-the-middle, the extension can capture anything you submit through web forms. That includes usernames, passwords, card details, personal information, session cookies from HTTP headers and API tokens pulled directly from network requests.
CyberGuy contacted Google about the extensions, and a spokesperson confirmed that both have been removed from the Chrome Web Store.
10 SIMPLE CYBERSECURITY RESOLUTIONS FOR A SAFER 2026
Two Chrome extensions posing as proxy tools were found spying on users for years while listed on Google’s official Chrome Web Store. (Yui Mok/PA Images via Getty Images)
How to review the extensions installed in your browser (Chrome)
The step-by-step instructions below apply to Windows PCs, Macs and Chromebooks. In other words, desktop Chrome. Chrome extensions cannot be fully reviewed or removed from the mobile app.
Step 1: Open your extensions list
- Open Chrome on your computer.
- Click the three-dot menu in the top-right corner.
- Select Extensions
- Then click Manage Extensions.
You can also type this directly into the address bar and press Enter:
chrome://extensions
Step 2: Look for anything you do not recognize
Go through every extension listed and ask yourself:
- Do I remember installing this?
- Do I still use it?
- Do I know what it actually does?
If the answer is no to any of these, take a closer look.
Step 3: Review permissions and access
Click Details on any extension you are unsure about. Pay attention to:
- Permissions, especially anything that can read or change data on websites you visit
- Site access, such as extensions that run on all sites
- Background access, which allows the extension to stay active even when not in use
Proxy tools, VPNs, downloaders and network-related extensions deserve extra scrutiny.
Step 4: Disable suspicious extensions first
If something feels off, toggle the extension off. This immediately stops it from running without deleting it. If everything still works as expected, the extension was likely not essential.
Step 5: Remove extensions you no longer need
To fully remove an extension:
- Click Remove
- Confirm when prompted
Unused extensions are a common target for abuse and should be cleaned out regularly.
Step 6: Restart Chrome
Close and reopen Chrome after making changes. This ensures disabled or removed extensions are no longer active.
MICROSOFT TYPOSQUATTING SCAM SWAPS LETTERS TO STEAL LOGINS
Cybersecurity experts warn that trusted browser extensions can become powerful surveillance tools once installed. (Gabby Jones/Bloomberg via Getty Images)
6 steps you can take to stay safe from malicious Chrome extensions
You can’t control what slips through app store reviews, but you can reduce your risk by changing how you install and manage extensions.
1) Install extensions only when absolutely necessary
Every extension increases your attack surface. If you don’t genuinely need it, don’t install it. Convenience extensions often come with far more permissions than they deserve.
2) Check the publisher carefully
Reputable developers usually have a history, a website and multiple well-known extensions. Be cautious with tools from unknown publishers, especially those offering network or proxy features.
3) Read multiple user reviews, not just ratings
Star ratings can be faked or manipulated. Look for detailed reviews that mention long-term use. Watch out for sudden waves of generic praise.
4) Review permissions before clicking install
If an extension asks to “read and change all data on websites you visit,” take that seriously. Proxy tools and network extensions can see everything you do.
5) Use a password manager
A password manager won’t stop a malicious extension from spying on traffic, but it can limit damage. Unique passwords mean stolen credentials can’t unlock multiple accounts. Many managers also refuse to autofill on suspicious pages.
Next, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com/Passwords) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.
Check out the best expert-reviewed password managers of 2025 at Cyberguy.com.
6) Install strong antivirus software
Strong antivirus software can flag suspicious network activity, proxy abuse and unauthorized changes to browser settings. This adds a layer of defense beyond Chrome’s own protections.
The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.
Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Kurt’s key takeaway
This attack doesn’t rely on phishing emails or fake websites. It works because the extension itself becomes part of your browser. Once installed, it sees nearly everything you do online. Extensions like Phantom Shuttle are dangerous because they blend real functionality with malicious behavior. The extensions deliver the proxy service they promise, which lowers suspicion, while quietly routing user data through attacker-controlled servers.
When was the last time you reviewed the extensions installed in your browser? Let us know by writing to us at Cyberguy.com.
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.
Copyright 2025 CyberGuy.com. All rights reserved.
Last month, Netflix made the surprising decision to kill off a key feature: With no prior warning, the company removed the ability to cast videos from its mobile apps to a wide range of smart TVs and streaming devices. Casting is now only supported on older Chromecast streaming adapters that didn’t ship with a remote, Nest Hub smart displays, and select Vizio and Compal smart TVs.
That’s a stunning departure for the company. Prior to those changes, Netflix allowed casting to a wide range of devices that officially supported Google’s casting technology, including Android TVs made by companies like Philips, Polaroid, Sharp, Skyworth, Soniq, Sony, Toshiba, and Vizio, according to an archived version of Netflix’s website.
But the streaming service didn’t stop there. Prior to last month’s changes, Netflix also offered what the company called “Netflix 2nd Screen” casting functionality on a wide range of additional devices, including Sony’s PlayStation, TVs made by LG and Samsung, Roku TVs and streaming adapters, and many other devices. Basically, if a smart TV or streaming device was running the Netflix app, it most likely also supported casting.
That’s because Netflix actually laid the groundwork for this technology 15 years ago. Back in 2011, some of the company’s engineers were exploring ways to more tightly integrate people’s phones with their TVs. “At about the same time, we learned that the YouTube team was interested in much the same thing — they had already started to do some work on [second] screen use cases,” said Scott Mirer, director of product management at Netflix at the time, in 2013.
The two companies started to collaborate and enlist help from TV makers like Sony and Samsung. The result was DIAL (short for “Discovery and Launch”) — an open second-screen protocol that formalized casting.
In 2012, Netflix was the first major streaming service to add a casting feature to its mobile app, which at the time allowed PlayStation 3 owners to launch video playback from their phones. A year later, Google launched its very first Chromecast dongle, which took ideas from DIAL and incorporated them into Google’s own proprietary casting technology.
For a while, casting was extremely popular. Google sold over 100 million Chromecast adapters, and Vizio even built a whole TV around casting, which shipped with a tablet instead of a remote. (It flopped. Turns out people still love physical remotes.)
But as smart TVs became more capable, and streaming services invested more heavily into native apps on those TVs, the need for casting gradually decreased. At CES, a streaming service operator told me that casting used to be absolutely essential for his service. Nowadays, even among the service’s Android users, only about 10 percent are casting.
As for Netflix, it’s unlikely the company will change its tune on casting. Netflix declined to comment when asked about discontinuing the feature. My best guess is that casting was sacrificed in favor of new features like cloud gaming and interactive voting. Gaming in particular already involves multidevice connectivity, as Netflix uses phones as game controllers. Adding casting to that mix simply might have proven too complex.
However, not everyone has given up on casting. In fact, the technology is still gaining new supporters. Last month, Apple added Google Cast support to its Apple TV app on Android for the first time. And over the past two years, both Samsung and LG incorporated Google’s casting tech into some of their TV sets.
“Google Cast continues to be a key experience that we’re invested in — bringing the convenience of seamless content sharing from phones to TVs, whether you’re at home or staying in a hotel,” says Google’s Android platform PM Neha Dixit. “Stay tuned for more to come this year.”
Google’s efforts are getting some competition from the Connectivity Standards Alliance, the group behind the Matter smart home standard, which developed its own Matter Casting protocol. Matter Casting promises to be a more open approach toward casting and in theory allows streaming services and device makers to bring second-screen use cases to their apps and devices without having to strike deals with Google.
“We are a longtime advocate of using open technology standards to give customers more choice when it comes to using their devices and services,” says Amazon Device Software & Services VP Tapas Roy, whose company is a major backer of Matter and its casting tech. “We welcome and support media developers that want to build to an open standard with the implementation of Matter Casting.”
Thus far, support has been limited though. Fire TVs and Echo Show displays remain the only devices to support Matter Casting, and Amazon’s own apps were long the only ones to make use of the feature. Last month, Tubi jumped on board as well by incorporating Matter Casting into its mobile apps.
Connectivity Standards Alliance technology strategist Christopher LaPré acknowledges that Matter Casting has yet to turn into a breakthrough hit. “To be honest, I have Fire TVs, and I’ve never used it,” he says.
Besides a lack of available content, LaPré also believes Matter Casting is a victim of brand confusion. The problem: TV makers have begun to incorporate Matter into their devices to let consumers control smart lights and thermostats from the couch. Because of that, a TV that dons the Matter logo doesn’t necessarily support Matter Casting.
However, LaPré also believes that Matter Casting could get a boost from two new developments: Matter recently added support for cameras, which adds a new kind of homegrown content people may want to cast. And the consortium is also still working on taking casting beyond screens.
“Audio casting is something that we’re working on,” LaPré confirms. “A lot of speaker companies are interested in that.” The plan is to launch Matter audio casting later this year, at which point device makers, publishers, and consumers could also give video casting another look.
Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.
NEWYou can now listen to Fox News articles!
If your inbox suddenly shows an Instagram “Reset your password” email you never requested, you are not alone. A wave of unexpected reset messages is hitting people right now, and attackers are betting you will panic, click fast and make a mistake.
Here is the tricky part. Many of these emails are real. They can come directly from Instagram because someone triggered the legitimate password reset flow. That makes the alert feel extra convincing, even when you did nothing wrong.
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.
FACEBOOK, INSTAGRAM ARE USING YOUR DATA TO TRAIN AI: LEARN HOW TO PROTECT IT
Unexpected Instagram password reset emails can look completely legitimate, which is why so many users are caught off guard during this surge. (Cyverguy.com)
Why Instagram password reset emails are surging
This surge is happening because the reset emails themselves can be real, even when the intent behind them is not. Instead of building fake phishing pages or using malware, attackers take advantage of Instagram’s normal account recovery system.
The process is simple. An attacker enters your username or email into Instagram’s real password reset form. Instagram automatically sends a legitimate reset email to you. The attacker then waits to see how you react.
At this point, your account has not been hacked. The risk comes from what happens next. Attackers are counting on common mistakes, such as clicking the reset button and rushing through the process, reusing a weak password, getting redirected to a fake follow-up page or falling for a second scam email that arrives soon after.
That is why this tactic works as a stress test. It creates urgency and pressure, even though nothing has been compromised yet.
Why attackers love this tactic
This is classic social engineering. The attacker does not need to outsmart Instagram. They need to outsmart you in a stressed moment. A reset email creates urgency. It also feels official. That combination leads people to click first and think second, which is exactly the outcome attackers want. You can treat these surprise reset emails as an early warning system. If you get one:
- Someone may know your username or email
- Your account could be on a target list from a leak or scrape
- Your current security setup will decide whether this stays annoying or turns into a takeover
If an email pressures you to act immediately, threatens account deletion or asks for extra information, treat it as suspicious.
The BreachForums leak connection
The timing of this surge has raised fresh concerns. Reports point to data tied to roughly 17.5 million Instagram accounts being shared on BreachForums, an underground forum where cybercriminals trade and discuss stolen data. The alleged post appeared in early January 2026, which lines up with when many users began reporting a sudden wave of password reset emails, sometimes receiving several in a short period of time.
This timing alone does not prove a direct connection. However, leaked usernames or email addresses can make it much easier for attackers to target large numbers of accounts at once, which is exactly what this kind of reset spam depends on. We reached out to Meta for comment but did not receive a response before our deadline.
We reached out to Meta for comment, and a spokesperson for the company told CyberGuy, “We fixed an issue that allowed an external party to request password reset emails for some Instagram users. We want to reassure everyone there was no breach of our systems and people’s Instagram accounts remain secure. People can disregard these emails and we apologize for any confusion this may have caused.”
How to tell if the reset email is legitimate
A legitimate Instagram reset email can still be part of an attack attempt. So your goal is not “confirm it is real,” it is “avoid reacting in a risky way.” Instagram’s own guidance boils down to this:
- A reset email alone does not mean your account is compromised
- If you did not request it, do not use the link
- Use Instagram’s official paths in the app to review security and report suspicious messages
Also, if you get emails about changing your account email address, Instagram says those messages can include a way to reverse the change, which can help you recover if someone broke in.
These real-looking messages are designed to create urgency and push people to click before slowing down and checking their account security. (Cyverguy.com)
What a real Instagram password reset email looks like
A legitimate reset email usually has these elements:
- Sender: Comes from an official Instagram domain, such as security@mail.instagram.com
- Subject line: Often says “Reset your Instagram password” or “Password reset request”
- Instagram branding: Logo at the top with clean formatting
- Call to action button: A button like “Reset Password”
- Reassurance text: A line explaining that if you did not request this, you can ignore the email and nothing will change
- Safety option: Language telling you how to report the email if you did not initiate it
This is why the current surge is so effective. The emails look normal and arrive from real Instagram systems.
META ENDS FACT-CHECKING PROGRAM AS ZUCKERBERG VOWS TO RESTORE FREE EXPRESSION ON FACEBOOK, INSTAGRAM
What Instagram reset alerts can look like inside the app
You may also see security messages directly in Instagram, such as:
- Login attempt alerts
- Notifications about a password reset request
- Prompts asking you to confirm a login from a new device
These in-app alerts are generally safer to interact with than email links, especially during a surge.
What scammers rely on
Attackers are counting on one thing: panic. When users see a reset email they did not request, many rush to click before reading the fine print. That fast reaction is what turns a harmless reset request into a real account takeover.
What to do right now if you get a reset email you did not request
So, what should you do if one of these password reset emails lands in your inbox? Take a breath first. Then do this.
1) Do not click the button in the email and use strong antivirus software
Even if the message looks real, treat it like a hot surface. If you want to change your password, do it from the Instagram app or by typing Instagram’s address into your browser yourself. Strong antivirus software adds another layer of protection here. It can help block malicious links, fake login pages and follow-up scams that often appear during a reset email surge.
The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.
Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com.
2) Check your Instagram security activity in the app
Open Instagram and look for signs someone tried to log in:
- Unknown devices
- Login alerts you do not recognize
- Changes to email, phone number or linked accounts
If anything looks off, remove the device and update your credentials.
3) Turn on two-factor authentication (2FA) and keep it on
Two-factor authentication (2FA) is the biggest roadblock for account takeover. Even if someone knows your password, they still need your code to get in from an unfamiliar device. Instagram has pushed 2FA heavily for higher-risk accounts and urges users to enable it. Use an authenticator app if you can. It is often safer than SMS.
4) Change your password if you feel unsure
If you suspect someone guessed your password, or you reused it elsewhere, change it. Make it long and unique. A password manager can help you generate and store strong passwords without reusing them. Then update the password on your email account too. Your email inbox controls most password resets, so make sure it also uses a strong, unique password.
Next, see if your email has been exposed in past breaches. Our #1 password manager (see Cyberguy.com/Passwords) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.
Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.
5) Use a data removal service to reduce targeting
Password reset surges often follow data leaks. When your email address and personal details appear on data broker sites, attackers can target you more easily. A data removal service helps limit where your information shows up online. By shrinking your digital footprint, you reduce the chances of being singled out during large-scale reset email attacks.
While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.
Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.
Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.
The safest response is to avoid email links, open the Instagram app directly and review login activity and security settings instead. (Kurt “CyberGuy” Knutsson)
6) Watch for follow-up scams
After a reset surge, criminals often switch tactics. Next, you may see:
- Fake “Instagram Support” emails
- DMs claiming your account will be deleted
- Login approval prompts you did not trigger
Slow down and verify everything inside the app.
Kurt’s key takeaways
A spike in Instagram password reset emails feels scary because it looks like someone is already inside your account. Often, they are not. Still, the surge is a reminder to tighten your basics. Use the app to check security. Turn on two-factor authentication. Change the passwords you reused. Most importantly, do not let an unexpected email rush you into the one click that hands over access.
Have you received an unexpected Instagram password reset email recently, and how did you handle it? Let us know by writing to us at Cyberguy.com.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – when you join my CYBERGUY.COM newsletter.
Copyright 2026 CyberGuy.com. All rights reserved.
Amazon has announced that the servers for New World: Aeternum, one of the company’s MMOs, will be shut down on January 31st, 2027. The game will also be delisted and no longer available for purchase starting today, January 15th.
Last year, Amazon announced that it would be pivoting away from MMOs to put more of a focus on party games, and the company said at the time that it wouldn’t be releasing new content for New World: Aeternum and that the game’s servers would be active through 2026. But the longer-term future of the game was unclear, and now we know the official day everything will be shut down.
If you have already purchased New World: Aeternum, you can play it until it’s permanently taken offline. The Marks of Fortune in-game currency will be unavailable to purchase starting July 20th, 2026, and Amazon won’t offer refunds for it. And while there’s no new content coming to the game, “we will continue to monitor bugs and performance to ensure the game runs smoothly as things wind down,” Amazon says.
Louisiana5 minutes ago
Louisiana DOGE final report shows nearly $1 billion in state savings
Maine11 minutes ago
Frigid Friday on tap in Maine before snow this weekend and more cold
Maryland17 minutes ago
No. 12 Maryland women’s basketball sneaks past USC, 62-55
Michigan23 minutes ago
Your votes: Who is the top forward in Division 2 Michigan high school girls basketball?
Massachusetts29 minutes ago
Massachusetts already has too few nurses. New student loan limits could make the shortage worse. – The Boston Globe
Florida1 year ago
Florida High School Football Rankings: Top 25 teams – Oct. 21
Connecticut2 years ago
Cleary's 21 help Le Moyne down Central Connecticut State 69-64 in OT
Oregon2 years ago
How old is Bo Nix? What to know about Oregon quarterback ahead of 2024 NFL Draft
Virginia1 year ago
99th annual Pony Swim held in Virginia
Education2 years ago
Video: ‘It Didn’t Have to Happen This Way:’ U.Va. Faculty Call for Review of Police Response to Protests
News4 hours ago
Video: Video Analysis of ICE Shooting Sheds Light on Contested Moments
Politics5 hours ago
Noem names Charles Wall ICE deputy director following Sheahan resignation
World6 hours ago
Israel continues deadly Gaza attacks as ceasefire deal moves into phase two
News7 hours ago
Venezuela’s Machado gave Trump her Nobel prize. In return she received a swag bag but no promise of support | CNN
News16 hours ago
Video: Runaway Emu Leads Sheriff’s Corporal on 45-Minute Chase
-
Montana6 days agoService door of Crans-Montana bar where 40 died in fire was locked from inside, owner says
-
Technology1 week agoPower bank feature creep is out of control
-
Delaware1 week agoMERR responds to dead humpback whale washed up near Bethany Beach
-
Dallas, TX1 week agoAnti-ICE protest outside Dallas City Hall follows deadly shooting in Minneapolis
-
Virginia6 days agoVirginia Tech gains commitment from ACC transfer QB
-
Iowa1 week agoPat McAfee praises Audi Crooks, plays hype song for Iowa State star
-
Montana6 days ago‘It was apocalyptic’, woman tells Crans-Montana memorial service, as bar owner detained
-
Nebraska1 week agoNebraska-based pizza chain Godfather’s Pizza is set to open a new location in Queen Creek