A widespread malicious operation on the Google Chrome Web Store has been uncovered, involving 737 fake VPN and proxy extensions that collectively accumulated nearly 75,000 installations.
Originally discovered by cybersecurity firm Socket and highlighted in reports by Bitdefender and BleepingComputer, the coordinated campaign hijacked users’ browser traffic by routing it through SOCKS5 proxy relays controlled by the threat actor.
Key Highlights of the Operation
- 737 Extensions Identified: Across at least 40 publisher accounts using a single shared analytics profile, researchers uncovered over 700 extensions linked to the same underlying infrastructure.
- Over 75,000 Downloads: The operation mainly targeted Russian-speaking users seeking to bypass government censorship and regional website blocks.
- Brand Impersonation: At least 274 extensions impersonated 66 well-known privacy and VPN brands, including Proton VPN, NordVPN, Surfshark, ExpressVPN, and Cloudflare’s 1.1.1.1 service.
- Shared Proxy Infrastructure: 520 of the analyzed extension packages configured Google Chrome to route all browser traffic through SOCKS5 proxy servers on port
1082. - Subscription Fraud & Evasion: The extensions promoted non-existent premium server locations (e.g., Japan, Australia, Singapore, Canada, Turkey) and used remote code injection post-approval to bypass Google Chrome Web Store vetting.
How the Campaign Worked
While standard VPN browser extensions naturally proxy web traffic, the malicious nature of this operation stems from deliberate deception, brand spoofing, and covert traffic control.
- Brand Spoofing & Deceptive Listings: Attackers uploaded extensions using trusted branding, stolen logos, and copy-pasted descriptions to lure users.
- Reviewer Evasion: The extension developers submitted misleading store disclosures claiming no external data collection or tracking. Once approved, dozens of extensions pulled down secondary remote configurations to alter behavior.
- Traffic Interception: By forcing browser traffic through actor-controlled SOCKS5 proxies, the operator could observe visited destinations, target domains (TLS SNI values), IP addresses, and unencrypted HTTP request content.
- DNS Obfuscation: Over 100 extensions resolved their proxy server hostnames using Google or Cloudflare DNS-over-HTTPS (DoH) to shield their backend IP addresses from security scrutiny.
Security Risks to Affected Users
Installing one of these malicious extensions puts user privacy and data security at severe risk:
- Eavesdropping on Web Browsing: Threat actors can monitor which sites you visit and intercept plain HTTP communications.
- Credential Exposure: Account login details submitted over non-HTTPS sites can be intercepted directly.
- Subscription Scams: Users were coaxed into paying for fake “premium” servers that did not exist or failed to function.
What You Should Do
If you suspect you have installed one of these extensions, take immediate remediation steps:
- Remove Unknown VPN Extensions: Go to
chrome://extensions/in your Chrome browser and uninstall any suspicious or unverified VPN/proxy extensions. - Reset Chrome Proxy Settings: Ensure your browser is no longer configured to route traffic through external proxy servers.
- Change Sensitive Passwords: Reset credentials for any accounts accessed while using the fake VPN—especially if accessed over unencrypted (HTTP) connections.
- Source Extensions Safely: Download extensions exclusively via direct links from an official provider’s verified website, rather than searching manually in the Web Store.