VPN Go Clipboard Stealer - Browser Extension File Hash IOCs

Lourenço Santos@lourenco

•updated Jun 30, 2026•0•0•2

Detects the confirmed-malicious CRX (Chrome) and XPI (Firefox) extension package hashes for the VPN Go campaign on endpoints. Map to your EDR file-hash field (e.g. Hashes / sha256).