Massive Campaign of Fake Chrome VPN Extensions Compromises User Traffic

• •737 fake Chrome VPN extensions have been identified, with significant user downloads.
• •The extensions route traffic through SOCKS5 proxies controlled by a single entity.
• •Over 500 of the malicious extensions are still active on the Chrome Web Store.

Over 737 fraudulent Chrome extensions masquerading as VPN services have been discovered, routing user traffic through SOCKS5 proxies controlled by a single provider. The extensions, which impersonate reputable brands like Proton VPN and NordVPN, have been downloaded nearly 75,000 times, primarily by Russian users seeking to bypass internet restrictions. Researchers from Socket identified that 40 publisher accounts were involved in this operation, with 516 extensions still active at the time of reporting. The malicious extensions were designed to intercept and read user data, including destination URLs and source IP addresses. Google has removed over 200 of these extensions, but many remain available for download. Users are advised to check their browsers for these extensions and ensure their proxy settings are restored to normal. The campaign appears to funnel users towards a subscription-based VPN service in Russia.