VPN Go Clipboard Stealer - Chrome Extension ID on Managed Endpoints

Lourenço Santos@lourenco

•updated Jun 30, 2026•0•0•2

Detects presence of the malicious Chrome extension ID in process command lines, file paths, or registry/preferences artifacts on managed endpoints. Tune logsource to your collection (Sysmon process_creation shown).