False VPN extensions in Chrome that intercept your traffic and watch you

Security researchers have identified a massive package of browser extensions that were presented as free VPN and proxy solutions, aimed mainly at Russian-speaking users seeking to circumvent blockages. According to the analysis published by the firm Socket and confirmed by researcher Kush Pandya, 737 supplements published from at least 40 developer accounts were detected in the Chrome Web Store, with a total of approximately 75,486 facilities. Of this set, 274 extensions imitated known privacy and VPN brands - including Proton VPN, NordVPN, Surfshark, AdGuard VPN, Browsec, ExpressVPN and others - and 221 have been removed by Google, while 516 remain active.

What do these extensions do technically and why are they dangerous: most of the identified accessories reconfigure the browser proxy using the chrome.proxy.settings API to set a SOCKS5 server in port 1082. In doing so, all browser requests are channelled through a relay controlled by the malicious actor. This positioning places the operator in a position of adversary-in-the-middle (AitM): you can see the destination addresses, the origin PIs that request the resources, the clear server names that appear in the TLS (SNI) negotiation and any content transmitted in flat text (HTTP). In addition, extensions include an exclusion list that only allows traffic to the loopback interface (localhost), which means that almost all the rest of the traffic passes through the malicious proxy.

Signs of fraud and evasion tactics: The set exhibits a series of deliberate indicators of abuse: many extensions announce "premium" plans or non-existent server locations, include internal instructions to avoid placing domains directly on chrome.proxy.settings (suggesting use of resolved IP addresses), add remote configuration layers after approval and raise identical justifications to the warehouse review process by saying "No data are transmitted to external servers." It has also been documented that some versions failed all connections while showing apparently legitimate connection interfaces, tactics designed to hide the real behavior of the user and human reviewers.

From the operational point of view, Pandya points out that 520 out of 522 extensions of a mass sample routing traffic to the same SOCKS5 infrastructure, indicating a centralized platform behind the scheme. The ownership of the servers is not conclusively established in the code: they could be operated directly by the actor or resold from a third party supplier, in which case another entity would have the same traffic inspection capacity.

Who does this affect? users who search for "VPN" or "proxy" extensions in the Chrome Web Store and install supplements without verifying their provenance are the most exposed. Given the stated goal towards Russian speakers and the offer of free or allegedly compatible services with censorship evasion, likely victims include activists, journalists, users who try to access blocked services and any account they trust in the browser for the transport of sensitive credentials or web services.

Practical implications: as long as a malicious extension is active and connected, the operator can correlate the user's identity (by public IP), the visited websites and, if the site does not use HTTPS, the content of the requests. Even with HTTPS, SNI exposure can reveal to which domains the user is connected; session metadata and any unencrypted resource are available for the interceptor. In addition, the imitation of reliable brands increases the probability of installation and reduces casual detection.

There are partial attribution elements in the finding: the packages contain a 12-digit tax contributor number and Windows compilation routes that include names in Cyrillic and personal directories (e.g., "C:\\ Users\\ ollob\\ OneDrive\\ Документы\\..."). These indications led researchers to estimate that the subscription business could operate from Russia, but that connection is not definitive: the use of local identifiers and file routes is strong circumstantial evidence but not a legally conclusive evidence of location or identity of the operator.

In parallel, Netskope Threat Labs reported the return of another problematic extension known as "AI Sidebar with Deepseek, ChatGPT, Claude, and more," which after removing exfiltration code in an update redistributed a monetization payload that opens affiliated links in foreground during updates and disinstallations. This case serves as a reminder: extensions can change their behavior after initial approval and use the update infrastructure to introduce malicious or unauthorized features.

What is confirmed, what is estimated and what remains uncertain: It is confirmed that hundreds of extensions configured SOCKS5 proxies and that thousands of facilities were produced; it is also confirmed that many imitate real marks and that 221 were removed. It is estimated - with documentary support in the packages - that the operation has links with actors in Russia, but that attribution is not categorical without additional evidence. The exact degree of ownership of the proxy infrastructure (own versus resold) and the actual scope of the intercepted traffic outside the sample are uncertain.

Specific recommendations and immediate action for readers: immediately disinstall extensions of VPN or proxy that have not deliberately installed or appear to imitate known marks; review the list of active extensions in chrome: / / extensions and disable those that request proxy control (or extensive permissions) unless they come from verified suppliers. Restore browser proxy settings if you suspect manipulation and, if necessary, restart Chrome profile or create a new one. It does not depend exclusively on end protection extensions; it prefers official VPN customers with native applications verified by the supplier or solutions at the operating system level. Change used credentials while extension may have been active and active authentication of two factors (2FA) in critical services.

If you want to deepen the technical risks of SNI and how even TLS connections can filter metadata, see technical explanations such as documentation about SNI and its risks on the Cloudflare portal: https: / / developed. For safe practices and recommendations on browser extensions and privacy, the Electronic Frontier Foundation guide is a practical resource: https: / / ssd.ef.org / en. And if you develop or publish extensions, review the policies of the Chrome Web Store ecosystem in: https: / / developer.chrome.com / docs / webstore / program _ policies /.

In conclusion, this campaign stresses that the mass distribution of false extensions continues to be an effective way to intercept traffic and defraud users; the combination of impersonation of brands and silent manipulation of the proxy makes an apparent privacy tool a surveillance vector. The rigorous control of installed extensions, the use of official software and the adoption of good cryptographic practices are concrete measures to reduce the risk immediately.