Fake VPN Extensions Put Operators in Adversary-in-the

Gbhackers •Mayura Kathir • August 12, 2026

A Chrome Web Store operation that turns “free VPN” extensions into browser-wide traffic relays controlled by a single proxy provider. The campaign comprises 737 extensions published by at least 40 developer accounts, with 274 masquerading as 66 recognised VPN and privacy brands. The listings have accumulated 75,486 bucketed installs; 516 remained live at collection time, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Massive Campaign of Fake Chrome VPN Extensions Compromises User Traffic Over 737 fraudulent Chrome extensions masquerading as VPN services have been discovered, routing user traffic through SOCKS5 proxies controlled by a single provider. The extensions, which impersonate reputable brands like Proton VPN and NordVPN, have been downloaded nearly 75,000 times, primarily by Russian users seeking to bypass internet restrictions. Researchers from Socket identified that 40 publisher accounts were involved in this operation, with 516 extensions still active at the time of reporting. The malicious extensions were designed to intercept and read user data, including destination URLs and source IP addresses. Google has removed over 200 of these extensions, but many remain available for download. Users are advised to check their browsers for these extensions and ensure their proxy settings are restored to normal. The campaign appears to funnel users towards a subscription-based VPN service in Russia. 4 sources 73

Fake VPN Extensions Put Operators in Adversary-in-the

The full story

Extracted Entities

Attack Types (1)

Platforms (1)