Troywell VPN Lite Remote PAC Script Injection

Overview

Troywell VPN Lite (4.0.6) is a working VPN/proxy client, but its proxy configuration is fetched from a remote server and installed as a PAC script, putting traffic routing under the operator's control. The extension holds broad permissions including proxy, webRequest, cookies, declarativeNetRequest, and . We found no code that exfiltrates cookies or executes remote code in this build, but the remote PAC mechanism is inherently risky.

How it works

On activation, the background script requests https://ext.troywell.org/api/vpnce/set/ (bg/bundle.js:1). The server responds with a URL, observed as https://ru.troywellvpn.com/connection-checker/, which is embedded into a PAC script string passed to chrome.proxy.settings.set({value:{mode:"pac_script",pacScript:{data:" function FindProxyForURL(url, host) {". Because the PAC is constructed from the server response, any change to that response silently changes how all browser traffic is routed. The extension also fetches analytics and ad-block rule lists from the vendor infrastructure (agreement/bundle.js:1) and references the cityads.com affiliate network (bg/bundle.js:1).

Payload

The primary payload is the remote PAC injection. The full PAC contents were not captured in our analysis; the endpoint varies responses per user/IP, and the sandbox run was inconclusive. The cookies permission is used by chrome.cookies.getAll in bg/bundle.js:1, but we did not observe any exfiltration to a third party.

Store status

Listed on the Chrome Web Store with ~50,000 users. A MalExt 'Malware' label was not confirmed by this build; it may refer to an older version not available for inspection. We rate this extension risky.