737 Fake Chrome VPN Extensions Hijack Browser Traffic Through Attacker

Cybersecuritynews •Tushar Subhra Dutta • August 12, 2026

Hundreds of Chrome extensions advertised as free VPN or proxy tools have been tied to a large traffic-redirection operation. The listings promised privacy and access to blocked services, but their code sent browser sessions through SOCKS5 proxy servers controlled by the operation. The scale makes the discovery especially concerning. Researchers counted 737 extensions published through […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Massive Campaign of Fake Chrome VPN Extensions Compromises User Traffic Over 737 fraudulent Chrome extensions masquerading as VPN services have been discovered, routing user traffic through SOCKS5 proxies controlled by a single provider. The extensions, which impersonate reputable brands like Proton VPN and NordVPN, have been downloaded nearly 75,000 times, primarily by Russian users seeking to bypass internet restrictions. Researchers from Socket identified that 40 publisher accounts were involved in this operation, with 516 extensions still active at the time of reporting. The malicious extensions were designed to intercept and read user data, including destination URLs and source IP addresses. Google has removed over 200 of these extensions, but many remain available for download. Users are advised to check their browsers for these extensions and ensure their proxy settings are restored to normal. The campaign appears to funnel users towards a subscription-based VPN service in Russia. 4 sources 73

Extracted Entities

737 Fake Chrome VPN Extensions Hijack Browser Traffic Through Attacker

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Tools (1)