Back Feeds.4Sysops

516 malicious Chrome VPN extensions remain active after proxy campaign

Feeds.4Sysops •IT News • August 12, 2026

More than 500 malicious Chrome VPN extensions remain available after researchers uncovered a campaign that routed browser traffic through attacker-controlled SOCKS5 proxies. The extensions impersonated major VPN brands and had accumulated 75,486 installs. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Massive Campaign of Fake Chrome VPN Extensions Compromises User Traffic Over 737 fraudulent Chrome extensions masquerading as VPN services have been discovered, routing user traffic through SOCKS5 proxies controlled by a single provider. The extensions, which impersonate reputable brands like Proton VPN and NordVPN, have been downloaded nearly 75,000 times, primarily by Russian users seeking to bypass internet restrictions. Researchers from Socket identified that 40 publisher accounts were involved in this operation, with 516 extensions still active at the time of reporting. The malicious extensions were designed to intercept and read user data, including destination URLs and source IP addresses. Google has removed over 200 of these extensions, but many remain available for download. Users are advised to check their browsers for these extensions and ensure their proxy settings are restored to normal. The campaign appears to funnel users towards a subscription-based VPN service in Russia. 4 sources 73

516 malicious Chrome VPN extensions remain active after proxy campaign

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)