737 Malicious Chrome VPN Extensions Caught Routing Traffic Through Proxies
Security researchers at Socket have uncovered a sprawling campaign involving 737 malicious Chrome VPN and proxy extensions that impersonate 66 well-known privacy brands to intercept browser traffic. The fake add-ons, published across at least 40 Chrome Web Store developer accounts, accumulated 75,486 installs before discovery. Researchers Kush Pandya identified that the extensions impersonated reputable services including Proton VPN, NordVPN, Surfshark, AdGuard VPN, Browsec, ExpressVPN, CyberGhost, Windscribe, TunnelBear, Cloudflare's 1.1.1.1, and Google's Outline. The campaign primarily targets Russian-speaking users seeking access to blocked services, with the threat actor operating a subscription VPN business out of Russia, evidenced by a 12-digit taxpayer number leaked in extension code and Windows build paths referencing Russian-language directories.
The technical core of the operation is alarmingly straightforward. The extensions configure Chrome's proxy settings to route every browser session through SOCKS5 proxies on port 1082, placing the operators in an adversary-in-the-middle position. This allows them to observe browsing destinations, source IP addresses, TLS SNI values, and any plaintext HTTP request bodies. A bypass list that only includes loopback addresses (127.0.0.1) ensures that virtually all browser traffic funnels through the attacker's relay once a user activates the extension. Of the 522 extensions in the bulk corpus, 520 route traffic through the same SOCKS5 infrastructure, suggesting a centralized operation. Additional red flags include DNS-over-HTTPS blocklist evasion, fake UI interfaces with animated connection indicators, and shipping internal manuals instructing employees on how to evade Chrome Web Store review processes.
As of reporting, 221 browser add-ons have been removed from the Chrome Web Store, but 516 extensions remain active. The defining tactic here is brand impersonation rather than novel exploitation: users believe they are installing legitimate VPN software, when in reality they are handing full visibility of their browsing activity to an unknown third party. Anyone who installed one of these extensions should immediately remove it and verify whether their traffic was compromised. Users can check their current connection for leaks and proxy exposure using the VPN/proxy detector and run a DNS leak test to confirm their DNS queries are not being intercepted by an unauthorized relay. For a broader assessment of browser privacy hygiene, the privacy checkup can help identify other exposed surfaces that malicious extensions often exploit.