737 fake Chrome VPN extensions intercepted the traffic of Russian-speaking users

Socket has reported a large-scale campaign in the Chrome Web Store: 737 free VPN and proxy extensions aimed primarily at Russian-speaking users seeking access to blocked services. The extensions were published from at least 40 developer accounts and together racked up 75,486 installs.

Of the extensions identified, 274 impersonate 66 well-known privacy brands — among them Proton VPN, NordVPN, Surfshark, AdGuard VPN, Browsec, ExpressVPN, CyberGhost, Windscribe, TunnelBear, Cloudflare 1.1.1.1, and Google's Outline. It is precisely the attempt to hide behind someone else's name, rather than operating under its own banner, that gives away the project's malicious nature: technically, its functionality differs little from a legitimate VPN.

How the interception works

According to researcher Kush Pandya, the extensions set a fixed SOCKS5 server on port 1082 in chrome.proxy.settings, routing the entire browser session through it. Only local addresses (127.0.0.1) are added to the exclusion list, so any other request goes out through the proxy. Of the 522 extensions in the main cluster, 520 use the same SOCKS5 infrastructure from a single provider.

From this “adversary in the middle” position, the operator sees destination addresses, source IPs, TLS SNI values, and the body of any request sent over plain HTTP. Whether the attacker owns these servers or resells someone else's capacity cannot be determined from the code — in the latter case, an upstream party also gains access to the traffic.

Signs of deception

The traces point to a subscription VPN business in Russia: a 12-digit INN and a leaked Windows build path with Russian-language folders. Among the warning signs are the advertising of nonexistent paid tiers and “premium” locations, the circumvention of blocklists via DNS-over-HTTPS, and a fake interface that shows a connection animation and status but deliberately fails every connection.

An internal document titled “Prompt for employees” is especially telling: it instructs staff not to write the domain directly into chrome.proxy.settings but to substitute a ready-made IP, and not to use third-party domains without separate instructions. The authors also added a layer of remote configuration only after approval, and submitted false statements to reviewers such as “no data is transmitted to external servers.”

Google has removed 221 extensions; the remaining 516 are still active. Users should review their installed VPN extensions and delete any that look suspicious.

In parallel, Netskope has recorded the return of the “AI Sidebar with Deepseek, ChatGPT, Claude, and more” extension: after being removed for data theft, it came back with a “clean” update and an admission of guilt, and two weeks later once again received a malicious payload — now opening an affiliate link on every update and uninstall.

Source: The Hacker News