← Campaigns
Troywell VPN
Troywell VPN Lite installs a PAC script fetched from its operator's server, letting that server redirect all browser traffic; remove the extension and treat accounts used while it was active as potentially exposed.
- Extensions
- 3
- Stores
- Chrome
- Updated
- 2026-10-27
- Disclosed
- 2026-09-03
- Last observed
- 2026-10-03
Member extensions
3 extensions| Extension | Store | Reported versions | Current risk |
|---|---|---|---|
| Troywell VPN Lite - unlimited VPN proxyhonjoefhlidgdidlcdbipobjnoliiaid | Chrome | Not specified | 64.99MEDIUM |
| 360 Filtergobmoeddfnndeoeeilijfconmieoffdf | Chrome | 0.9.2 | 43.58MEDIUM |
| Webfilterpmddkjdpfjofgieiiblncjmahjobjadc | Chrome | 5.0, 5.3 | 27.56LOW |
Indicators
Download STIX →Browse 4 indicators
| Type | Value & evidence |
|---|---|
| sha256 | e87abbdb2de65b2d58f3da6e969345c3211672977ef1d10c3015132b0bee14b3full CRX, analysed build archived in R2 (360 Filter 0.9.2) |
| sha256 | d039c416e44e0aedba237a0cfd09244686df581f9d0a180b7ff7acf1d9d4f1fffull CRX, analysed build archived in R2 (Webfilter 5.0) |
| domain | ext.troywell.orgRemote PAC/config endpoint |
| domain | ru.troywellvpn.comConnection checker URL returned by endpoint |