VPN Go Clipboard Stealer - C2 Infrastructure (IP IOCs)

Lourenço Santos@lourenco

•updated Jun 30, 2026•0•0•7

Detects network connections to hardcoded threat-actor IPs used by the VPN Go extensions for clipboard exfiltration (/html/continue.php) and proxy-location retrieval (/locations). Covers Chrome 1.1-1.3 and Firefox 1.3.3-1.3.4 infrastructure.