Socket's research

The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.

Socket's Threat Research Team identified a campaign of 737 free VPN and proxy extensions published across at least 40 Chrome Web Store developer accounts, 274 of which impersonate 66 established VPN and privacy brands, that route the user's entire browser session through SOCKS5 proxies operated by a single provider. Socket analyzed the code of 525 of them, 522 from bulk retrieval and 3 more found during store enumeration; the remaining 212 had been removed from the store before collection and were recovered at listing level only. 520 of the 522 in the bulk corpus route browser traffic through the same SOCKS5 infrastructure.

The campaign has accumulated 75,486 installs across 737 extensions, of which 516 were listed as active when the corpus was collected, carrying 58,318 installs. Install counts are the Chrome Web Store’s bucketed display values, so these are sums of buckets rather than exact headcounts.

The campaign splits into three connected threat behaviors:

Socket observed the client side only. The extensions place the threat actor in a position to read all browser traffic, and this report makes no claim what the proxy servers retain or transmit. What is established from the packages and from public infrastructure is the impersonation, the undisclosed proxy configuration, the non-existent premium servers, the false statements submitted to store reviewers, and the post-approval code substitution.

The populations behind the numbers in this post:

The same threat actor runs a subscription VPN business in Russia. Its published contract names an active, tax-registered self-employed provider, and its billing dashboard sells the browser extension as a paid tier. The extension estate is that business’ customer acquisition funnel.

The extensions target Russian-speaking users seeking to reach services blocked inside Russia, including Instagram, ChatGPT, and YouTube. 690 of the 734 extensions in the source dataset are Russian-targeted by at least one of three tests: a Cyrillic listing name, a Cyrillic manifest description, or a blocked-service name in the listing. 520 of the 522 retrieved manifests carry Russian descriptions.

Listings promise IP masking and traffic protection. One manifest in hfanmgjobgojpieocfemecgcgglmgpff reads:

That translates to “Hides IP and protects data, suitable for any devices and sites. Recommended by Yuriy Dud.” Yuriy Dud is a Russian journalist with no connection to this campaign, and the claim appears in an extension from an estate that impersonates 66 other real brands. Socket found no public record of any endorsement.

66 real software brands are impersonated across 274 extensions and 38,140 installs, including Proton VPN, NordVPN, Surfshark, AdGuard VPN, Browsec, ExpressVPN, CyberGhost, Windscribe, TunnelBear, Cloudflare’s 1.1.1.1, and Google’s own Outline. Two impersonation targets are notable because they are the tools Russian users specifically trust to circumvent blocking: AmneziaVPN (22 extensions) and AntiZapret.

Every retrieved extension that configures a proxy at all, 520 of 522, performs the same operation. From aabaifmlfkdolhdbbhjblkeekaijfdfh/worker.js :

BYPASS_LIST contains only loopback addresses. Every other destination, for every tab, is forced through the threat actor's SOCKS5 node once the user clicks Connect. There is no per-site scoping and no split tunneling.

SOCKS5 as configured here is a bare relay. It adds no encryption, sets no proxy credentials, and does nothing WebRTC or operating-system DNS. 497 of the 522 request proxy and nothing else; the remainder add only storage , with one exception each for activeTab and notifications .

Everything the extensions do not see, the proxy does. With all browser traffic forced through it, the threat actor’s server is positioned to read every destination, every TLS SNI value, the victim’s source IP, and any request body sent over plain HTTP. For a user in Russia, source IP plus timestamp is identity-adjacent, because an ISP can resolve it.

The connected state renders the word “Защищено” (“Protected”) in 67 of 91 extensions in one code generation.

At the mechanism level, no. A browser-scoped VPN has one API available to it, chrome.proxy , and a fixed-server SOCKS5 configuration with a loopback-only bypass list is the ordinary way to implement one. Any extension that proxies browser traffic necessarily places its operator in a position to observe that traffic. A provider building a genuine censorship-circumvention tool for Russian users would produce something that looks very much like the code above. The proxy hijack is the capability, not the finding.

What separates this campaign from that hypothetical is everything around the proxy. A legitimate provider competes under its own name; 274 of these extensions impersonate 66 established brands, including AmneziaVPN and AntiZapret, the two tools this audience specifically trusts to get around blocking. A legitimate provider does not advertise server locations that do not exist; all 200 jp , sg , ca , au and tr subdomains across the 40 apex domains tested return no A record, and those are exactly the entries marked premium: true . A legitimate provider does not ship a paywall that cannot be satisfied, or an extension hardcoded to fail every connection behind a working connecting animation. A legitimate provider does not submit nine byte-identical justifications to store reviewers stating "No data transmitted to external servers" while shipping a proxy. A legitimate provider does not add an entire remote-configuration layer after approval, in a build whose reviewed predecessor contained none of it. And a legitimate provider does not write an internal manual telling staff never to put a domain into chrome.proxy.settings , only the resolved IP, so that the destination cannot be read out of the shipped package.

Each of those is a choice with no operational benefit to a service that intends to deliver what it sells. Each is documented in the sections that follow.

104 extensions declare host permissions for cloudflare-dns.com and dns.google , then resolve their own proxy hostname before configuring the proxy. From abjgfdfbmmijjdfbohbhgdnjeipjbplj/worker.js :

The resolved IP literal, not the hostname, is what reaches chrome.proxy.settings . No plaintext DNS query for the threat actor's domain is emitted while useDnsResolve is true, which is its value in every shipped node list Socket examined.

resolveDomain queries cloudflare-dns.com/dns-query and falls back to dns.google/resolve , caching results for five minutes and selecting a random A record. This technique is documented, not incidental. One extension, kcplchjjdpgehfdlggggoohdeoaikcan , shipped an internal build manual titled “Промт для сотрудников” (“Prompt for employees”).

It contains a project domain field filled in with skyproxy[.]space , a country-to-subdomain mapping, paste-ready implementation code, a pre-delivery checklist, and a section listing what staff must not do:

“Do not put the domain directly into chrome.proxy.settings, only the IP after resolution.” And: “Do not use a domain from another extension without separate instruction.” The second instruction compartmentalizes domains across extensions: no extension may reuse another’s. The effect is that a takedown of one domain does not reach the others.

66 extensions chase HTTP redirects at runtime to locate whichever threat actor domain is currently live, then pull configuration from it. The excerpt below combines resolveAssetsOrigin() and the fetchLandingLinks() call that follows it. redirect: "manual" lets the code read the 3xx Location header itself and follow it to an origin that is not hardcoded in the package, which means the threat actor can relocate destinations for already-installed copies without shipping an update. From abjgfdfbmmijjdfbohbhgdnjeipjbplj/core.js :

Following those live redirects exposed a domain tier that appears in none of the 522 retrieved packages: myxavpn[.]site , myxavpn[.]online , myxavpn[.]tech , and myxasafe[.]space .

Every extension advertises premium locations. DNS resolution shows that the free-tier subdomains resolve and the premium ones do not. For stealthpath[.]space :

All 200 jp , sg , ca , au , and tr subdomains across the 40 apex domains tested returned no A record. In the shipped server lists, those are precisely the entries marked premium: true .

The paywall has no working unlock path either. In hfanmgjobgojpieocfemecgcgglmgpff/sw.js , one of the 88 packages built on the sw.js layout, the entire license check is:

Any non-empty string unlocks every premium server, and no code anywhere in that group of packages ever writes premiumKey to storage, so the paywall cannot be satisfied through the extension's own interface.

A second generation ships a hardcoded secret with a non-cryptographic hash presented as a license signature. From ladjabmcgadeknpfngdihgeimccmgmpj/src/core/tokenVerifier.js :

That is a 32-bit rolling hash of the hash*31 form used by Java's String.hashCode , not an HMAC. Secret and algorithm both ship in plaintext, so any user can forge a permanently valid token offline.

That secret appears in 10 extensions across 10 separate publisher accounts. Seven of them split it across variables to defeat string :

ilpcglpcfdeoehcmjhkfhhgpldgfgjhj , published as “Burёnka VPN”, advertises servers in seven countries. Its server list contains 15 entries pointing at a non-routable address, under the threat actor’s own :

Not one server in the package is marked premium: false , so no free tier exists. And the connect handler is hardcoded to fail:

Every connection attempt returns failure regardless of which server the user selects. The package ships a complete fake interface, including a connecting animation and status indicator, over a proxy engine that cannot function.

Its homepage_url is a Telegram bot deep link carrying a referral code, the only thing in the package that reaches outside its own interface.

aaeiefggdeljohngedhpmgidkjcdoebb/background.js contains a recording the threat actor’s expectation that the behavior violates store policy, alongside the code that ships it anyway. The below are verbatim from the file, threat actor's own included. The Chrome Web Store line translates as: "If Chrome Web Store rejects this because of automatically opening links, we can replace it with a notification offering to go to the Telegram bot.”

Four lines later the same file notes that chrome.tabs.create with external URLs may require the tabs permission and that it could be added. It was not added. That extension’s shipped permission set is ["proxy", "storage", "notifications"] .

oaidiemgjmaabehcfjfbkeifdpeniemm accidentally shipped a 1.5 MB archive named vpn-bez-limita.zip inside its own published package. The archive is that extension’s superseded v1.0.0 build, meaning the artifact Google reviewed. Comparing it against the live v1.0.1 shows the entire remote-configuration layer was added after approval. In the reviewed build, resolveAssetsOrigin , fetchLandingLinks , refreshRemoteQr , and config/links.json appear zero times. In the shipped build they appear three, three, two, and one time respectively.

The manifest difference between reviewed and shipped is only a version bump and the store’s automatically added update_url . The permission set stayed ["proxy"] , so a permission diff between the reviewed and shipped builds is empty. Campaign-wide, 49 extensions across 18 publisher accounts received post-approval code updates, covering 8,076 installs, and 31 of those are still live.

10 extensions shipped store-assets/PRIVACY_JUSTIFICATIONS.md , the justification text submitted to Chrome Web Store reviewers. Nine are byte-identical, SHA-256 1dea4975f7aaba71bf7821fcf62deca470ef5e21f45c947b103ddeb836ef9b81 , across nine separate publisher accounts. The document asserts “No personal data collected,” “No data transmitted to external servers,” “No user tracking or logging,” and “This extension does NOT use remote code.”

The 737 extensions are one operation. Six independent classes of evidence establish it.

The extensions declare it themselves. 360 of 522 retrieved packages, spanning 34 of 37 publisher accounts, render a string in the popup naming their own supplier. 330 read Premium доступ предоставляет официальный VPN провайдер Myxa VPN , “Premium access is provided by the official VPN provider Myxa VPN.” A further 30 read Ключ предоставляет официальный VPN провайдер Муха VPN , "the key is provided by the official VPN provider Муха VPN," using the Cyrillic spelling of the same brand.

One build machine. 43 packages shipped a build-info.json that leaks the threat actor’s Windows build path: C:\Users\ollob\OneDrive\Документы\1.myxa-work\08.06.26\ \ \ -release.zip . One Windows account, one project directory, extensions published under many different accounts.

One analytics account. Eight Yandex Metrika counters partition 49 threat actor domains with zero overlap. Counter 108155174 is installed on myxavpn[.]pro , the commercial storefront, and on the extension-farm landing domains vpnmyxa[.]site , vpnmyha[.]shop , and vpnkomar[.]space . A Metrika counter ID belongs to one Metrika account and reports only to it, so the same counter across these sites indicates shared control, linking the subscription business to the extension estate. Webvisor session recording is enabled on the landing pages.

Bulk domain registration. 21 domains were registered inside a 10-second window on 2026-05-20 between 07:30:35 and 07:30:45 UTC. A further 14 were registered within 24 seconds on 2026-04-05.

One registrar and one dedicated host. The estate of at least 102 apex domains sits on the nameserver pair ns1[.]reg[.]ru and ns2[.]reg[.]ru . 43 of the first 51 resolve to a single IP, 212[.]192[.]14[.]75 , running nginx 1.24.0 on Ubuntu. Reverse-IP lookups on that host returned only campaign domains, which is what allowed a further 51 apex domains to be recovered from it.

One build pipeline across two code generations. The byte-identical /* finalize_ext: auto-open premium URL on first install */ appears in 26 extensions across 20 publisher accounts, in both sw.js and worker.js files, marking a generator pass that appends a second onInstalled listener.

The brand is «Муха VPN», Russian for "fly." Rendered in Latin lookalike characters the Cyrillic «Муха» becomes myxa , which is why both spellings appear across the estate and why the domains read as they do. It also explains the naming scheme: myxavpn (fly), vpnkomar (mosquito), zhuknet (beetle), tarakanvpn (cockroach), pauktun (spider), sverchvpn (cricket), osavpn (wasp), shershvpn (hornet), korovkavpn (ladybird), usachvpn (longhorn beetle), and gusenvpn (caterpillar). One domain, maskirovka[.]space , takes its name from the Russian word for camouflage, also a term of art in Russian military doctrine.

Russian law requires a public offer to name the contracting party, and myxavpn[.]pro/oferta/ does:

That declares the provider to be a self-employed individual, identified by a 12-digit taxpayer number. A 12-digit INN is issued to a natural person, not an organization. Socket checked it against the Russian Federal Tax Service's public self-employment (НПД) taxpayer-status service, an endpoint that exists so businesses can verify a contractor's standing before contracting and that returns status only, with no name attached. It confirmed an active professional income tax registration. The endpoint rate-limited after that query, so we obtained no negative control against an unregistered number, though the response was specific rather than a bare true : it echoed the queried number and named the exact tax regime. No company name, registration number, address, or director is published anywhere.

Two things are established. The threat actor published this number as its own contracting party, and the number corresponds to a live tax registration. A third is not. Socket did not resolve the number to an individual, did not attempt to, and does not assert that the registrant is the person operating this campaign. Self-employed status in Russia can be held on another party's behalf, and nothing in the extension code or the public infrastructure settles that question either way. Identifying the person behind a published taxpayer number is a step for a party acting under legal authority.

Certificate Transparency dates xray[.]myxavpn[.]com to 2024-11-06, the earliest issuance anywhere in the estate and roughly 14 months before the first extension in the dataset, with monitoring[.]myxavpn[.]com running Grafana from 2024-11-27 and git[.]myxavpn[.]com hosting self-managed source control from 2025-01-05. myxasecure[.]space additionally carries jitsi and rocket hosts, meaning self-hosted video conferencing and Rocket.Chat.

app[.]myxavpn[.]pro is a Telegram Mini App billing dashboard selling EXTENSION , PRO , and MAX plans. The EXTENSION tier is priced from 99 roubles per month and described as “VPN in browser only.” Its bundle hardcodes exactly one Chrome extension ID, aaeiefggdeljohngedhpmgidkjcdoebb , in a sub_type === "BROWSER_EXT" card and a setup wizard. That extension has 2,000 installs and is live.

The dashboard’s CSP header exposed sub[.]myxasecure[.]space , a domain absent from all 522 retrieved packages. Node configuration for it was recovered on 2026-07-30 from five public V2Ray aggregator repositories that had republished the threat actor’s subscription output, showing VLESS-REALITY on port 443 rather than SOCKS5 on 1082. Socket did not purchase a subscription or connect to a node, so the paid tier’s operation is unverified. The protocol difference is the point: VLESS-REALITY is built to survive the deep packet inspection that blocks VPNs in Russia, while the extension estate ships the plaintext relay.

A service sold to Russian users specifically for censorship circumvention advertises no logging on a page that records IP addresses, and until recently published a commitment to disclose data to the authority responsible for that censorship.

This is a compliance posture, not a state connection. Any Russian-registered data processor carries comparable obligations, and Socket found no indicator of state sponsorship or tasking anywhere in this campaign.

For each affected user, while the extension is connected, every request passes through a server the threat actor controls, in a position to read the full set of destinations the browser reaches, the TLS SNI value of every HTTPS connection, the user’s source IP address, and the complete contents of any request sent over plain HTTP, including credentials submitted to non-HTTPS sites.

Whether the threat actor owns those proxy servers or resells capacity from an upstream provider is not resolvable from the extension code. If it resells, a further party is in the same position.

The victim population makes this material. 94% of the campaign targets Russian speakers, and the inducement is access to blocked services. These users selected a privacy tool specifically to protect traffic they consider sensitive, and the product routes exactly that traffic through infrastructure controlled by a party they cannot identify. Extensions impersonating AmneziaVPN and AntiZapret reach users who deliberately sought a tool they had reason to trust.

Users who purchased a premium subscription paid for server locations that did not resolve at any point during this investigation.

Google has acted on this campaign. 221 of the 737 extensions have been removed from the Chrome Web Store, including 14 of the 15 that Palo Alto Networks named publicly on 2026-06-05 and that were still live at the time, every one of those within seven weeks of that publication. Removal is a deliberate act by the store, so the campaign is known to it. What the removals did not reach is the other 516.

Normalizing every live service worker into a code skeleton, with , string literals, numeric literals, and whitespace removed so that branding and server lists cannot affect the hash, produces 93 distinct skeletons across 409 live workers.

One skeleton has 51 members spread across 8 publisher accounts. Google removed exactly one of them, ofbdlgcpfnhcidmfmddnkkbkejjoffdf , which carried 37 installs. The remaining 50 are live and carry 3,217 installs, and every one is structurally identical to the extension that was taken down.

Among those 50 is ilbpmeeaifiojjiohfffjmgpgcfcaajg , published as "1.1.1.1 VPN" and copying Cloudflare's branding outright. It is live, with 1,000 installs and a 5.0 rating from 8 reviews, and the store surfaces no warning to a prospective installer.

The account economics explain the persistence. A Chrome Web Store developer account costs $5. The 38 accounts in the source dataset cost the threat actor $190 and published 737 extensions, which is $0.258 per extension and $0.00326 per surviving install. An account publishes a mean of 9.1 extensions before its first removal, then continues and publishes a mean of 15.8 more over a further 69 days. 28 of 29 core accounts kept publishing after their first removal, and 29 of the 30 accounts that have had an extension removed still hold live extensions. Extensions are removed. Publishers are not.

Palo Alto Networks published on part of this campaign on 2026-06-05, naming 18 extension IDs. All 18 appear in Socket’s set. Three had already been removed before publication, and 14 of the remaining 15 were removed in the seven weeks after it. The 15 publisher accounts behind them retained 250 live extensions carrying 26,151 installs, and sverchtun[.]store , named in that brief as an indicator, still resolves and now fronts ten proxy IPs, eight of which are on ranges absent from the fifteen Palo Alto listed.

Remove any VPN extension from this campaign immediately and confirm that Chrome’s proxy configuration has returned to normal at chrome[://]settings , searching for “proxy.” Change credentials entered on any non-HTTPS site while the extension was connected, and treat browsing history from that period as observed by a third party. A browser extension requesting the proxy permission can redirect all traffic; it is worth confirming that the publisher is the brand it claims to be before installing, because 66 real brands are impersonated in this campaign alone.

Extensions that request proxy warrant the same scrutiny as extensions that request . The permission is narrow in appearance and total in effect. In this campaign the permission footprint stayed ["proxy"] across a post-approval change that added an entire remote-configuration layer, so permission diffs alone do not detect capability changes.

Block the network indicators below at DNS and at egress. DNS blocking alone is insufficient against the 104 extensions that resolve their proxy hosts through DNS-over-HTTPS and pin a raw IP, so the proxy IP ranges require separate handling. Blocking SOCKS5 on port 1082 does not affect the VLESS-REALITY tier on port 443. Inventory installed browser extensions for the proxy permission and alert on chrome.proxy.settings modification. Cluster candidate extensions by normalized code skeleton rather than by extension ID, since this campaign regenerates variable names, function names, and per build, producing a unique file hash for every logically identical file.

Socket’s Chrome extension protection analyzes extension bundles for hidden data flows, undisclosed credential exfiltration, and C2 backdoors, blocking malicious extensions before they reach user endpoints.