News

A widespread malicious operation on the Google Chrome Web Store has been uncovered, involving 737 fake VPN and proxy extensions that collectively accumulated nearly 75,000 installations.

Originally discovered by cybersecurity firm Socket and highlighted in reports by Bitdefender and BleepingComputer, the coordinated campaign hijacked users’ browser traffic by routing it through SOCKS5 proxy relays controlled by the threat actor.

Key Highlights of the Operation

• 737 Extensions Identified: Across at least 40 publisher accounts using a single shared analytics profile, researchers uncovered over 700 extensions linked to the same underlying infrastructure.
• Over 75,000 Downloads: The operation mainly targeted Russian-speaking users seeking to bypass government censorship and regional website blocks.
• Brand Impersonation: At least 274 extensions impersonated 66 well-known privacy and VPN brands, including Proton VPN, NordVPN, Surfshark, ExpressVPN, and Cloudflare’s 1.1.1.1 service.
• Shared Proxy Infrastructure: 520 of the analyzed extension packages configured Google Chrome to route all browser traffic through SOCKS5 proxy servers on port 1082.
• Subscription Fraud & Evasion: The extensions promoted non-existent premium server locations (e.g., Japan, Australia, Singapore, Canada, Turkey) and used remote code injection post-approval to bypass Google Chrome Web Store vetting.

How the Campaign Worked

While standard VPN browser extensions naturally proxy web traffic, the malicious nature of this operation stems from deliberate deception, brand spoofing, and covert traffic control.

1. Brand Spoofing & Deceptive Listings: Attackers uploaded extensions using trusted branding, stolen logos, and copy-pasted descriptions to lure users.
2. Reviewer Evasion: The extension developers submitted misleading store disclosures claiming no external data collection or tracking. Once approved, dozens of extensions pulled down secondary remote configurations to alter behavior.
3. Traffic Interception: By forcing browser traffic through actor-controlled SOCKS5 proxies, the operator could observe visited destinations, target domains (TLS SNI values), IP addresses, and unencrypted HTTP request content.
4. DNS Obfuscation: Over 100 extensions resolved their proxy server hostnames using Google or Cloudflare DNS-over-HTTPS (DoH) to shield their backend IP addresses from security scrutiny.

Security Risks to Affected Users

Installing one of these malicious extensions puts user privacy and data security at severe risk:

• Eavesdropping on Web Browsing: Threat actors can monitor which sites you visit and intercept plain HTTP communications.
• Credential Exposure: Account login details submitted over non-HTTPS sites can be intercepted directly.
• Subscription Scams: Users were coaxed into paying for fake “premium” servers that did not exist or failed to function.

What You Should Do

If you suspect you have installed one of these extensions, take immediate remediation steps:

1. Remove Unknown VPN Extensions: Go to chrome://extensions/ in your Chrome browser and uninstall any suspicious or unverified VPN/proxy extensions.
2. Reset Chrome Proxy Settings: Ensure your browser is no longer configured to route traffic through external proxy servers.
3. Change Sensitive Passwords: Reset credentials for any accounts accessed while using the fake VPN—especially if accessed over unencrypted (HTTP) connections.
4. Source Extensions Safely: Download extensions exclusively via direct links from an official provider’s verified website, rather than searching manually in the Web Store.

Click Here to Buy a NordVPN Plan

For years, the formula for basic online safety was simple: download an antivirus program to catch computer viruses, and turn on a VPN when connecting to public Wi-Fi.

However, modern cybercrime doesn’t work like it used to.

In 2026, cybercriminals rarely waste time writing traditional file-based malware to infect your hard drive. Instead, today’s top threats rely on social engineering, AI-driven SMS phishing, fake online storefronts, and credential leaks. A standard VPN encrypts your connection, but it won’t stop you from typing your credit card into a convincing phishing site.

To address this gap, NordVPN announced a major evolution in its platform strategy: repositioning the service as an all-in-one digital security app.

The 3 Pillars of NordVPN’s New Security Architecture

Instead of juggling multiple expensive software subscriptions—a VPN, a separate antivirus tool, a password manager, and an identity monitoring service—NordVPN consolidated these features into three distinct operational pillars inside a single app:

1. Connect (The Core VPN)

The foundation remains NordVPN’s ultra-fast global network spanning over 111 countries.

• What it does: Encrypts internet traffic, hides your IP address, and bypasses regional censorship or geo-blocks.
• Standout feature: Includes Meshnet, a free feature allowing you to create private, encrypted peer-to-peer tunnels between your own devices worldwide (ideal for remote work and file transfers without exposing your network).

2. Protect (Next-Generation Antivirus)

Traditional antivirus software acts reactively—it alerts you after a bad file lands on your hard drive. NordVPN’s new Protect engine operates proactively at the web-request layer.

• What it does: Scans web traffic in real time to block fake shopping portals, phishing links, intrusive ad trackers, and malicious file downloads before they touch your device.
• Scam Protection: Automatically identifies and alerts users to high-risk links sent via mobile SMS or messaging apps.

3. Monitor (Identity & Data Breach Tracking)

Data breaches happen constantly, exposing passwords, emails, and financial details on hidden forums.

• What it does: The Dark Web Monitor continuously scans underground marketplaces for your personal information.
• What happens if you’re exposed: If your email or passwords surface in a fresh data leak, the app immediately sends an alert with step-by-step instructions on how to secure the affected account.

Does This Compromise Privacy?

A common question among privacy advocates: If NordVPN is scanning for phishing sites and malware, does that mean they are watching everything I do online?

NordVPN addresses this through a privacy-first design architecture. The app uses machine learning engines operating under a “minimum signal” rule. Threat decisions are processed locally or via anonymized cryptographic hashes. The service continues to operate under a strict, independently audited No-Logs Policy, ensuring that browsing history is never logged, sold, or monitored.

Verdict: Is the New NordVPN Plan Worth It?

If you are paying separately for a standalone VPN, an antivirus program, and identity theft alerts, you are likely overpaying by $100+ per year.

By consolidating these functions into a single interface under the Connect, Protect, and Monitor framework, NordVPN delivers comprehensive digital protection at a fraction of the cost—without slowing down your PC or mobile device.

Who Should Get It?

• Travelers & Digital Nomads: Secures coffee shop Wi-Fi while protecting mobile devices from SMS scams abroad.
• Everyday Browsers: Stops phishing links, fake store scams, and malicious ad networks before they load.
• Bargain Hunters: Consolidates 3 software bills into one low monthly subscription.

Click Here to Buy a NordVPN Plan