17 Mozilla Firefox browser add-ons' logo files have been used in a new campaign called GhostPoster. Koi Security, which found the campaign, claims that the extensions have been downloaded more than 50,000 times in total. These browser apps were marketed as unofficial Google Translate versions, screenshot tools, VPNs, and ad blockers.

Dark Mode, the oldest add-on, was released on October 25, 2024, and it allows all websites to have a dark theme. Security researchers Lotan Sery and Noga Gouldman stated, "What they actually deliver is a multi-stage malware payload that monitors everything you browse, strips away your browser's security protections, and opens a backdoor for remote code execution." The announcement follows the discovery of a well-known VPN extension for Microsoft Edge and Google Chrome. surreptitiously gathering AI conversations from Gemini, Claude, and ChatGPT and sending them to data brokers.

Another Chrome extension called FreeVPN was released in August

2025.One was seen gathering user locations, system data, and screenshots.

"Free VPNs promise privacy, but nothing in life comes free," stated Koi Security. "Again and again, they deliver surveillance instead," the business stated in a blog post regarding the extension. Since then, the extension has been taken down from both the Chrome Web Store and the Google Play store.

The company has not stated whether the extension will be made available on Apple's iOS and Android operating systems in the future or if it will be taken down from Google Play or the Chrome App Store in the near future. similar to the mobile operating systems for iOS and Android. Google Play offers the Chrome extension for free, while the Apple App Store charges $3.99 a month for it.

Visit www.freeVPN.com to learn more about the FreeVPN extension.