Security researchers uncovered a sprawling operation that placed more than 75,000 Chrome users at risk. The scheme relied on 737 browser extensions. Many copied the look and names of established VPN services. They promised privacy. Instead they funneled every web request through proxy servers controlled by a single operator.
Socket’s Threat Research Team laid out the findings in exhaustive detail. The extensions appeared across at least 40 developer accounts on the Chrome Web Store. Of those, 274 impersonated 66 recognized brands. The list includes NordVPN, Proton VPN, Surfshark, ExpressVPN, Cloudflare’s 1.1.1.1 service, and several others. (Socket)
Users in Russia and Russian-speaking regions formed the main target audience. They sought ways around blocks on Instagram, ChatGPT, YouTube and similar platforms. The extensions posed as free tools for censorship circumvention. Their real purpose looked different.
Traffic flowed straight into the operator’s hands.
Most of the extensions set Chrome’s proxy configuration to a fixed SOCKS5 server on port 1082. The change applied to the entire browser session. No per-site exceptions. The bypass list contained only loopback addresses. Everything else passed through the proxy. That placed the operator in an adversary-in-the-middle position. They could see destination domains, source IP addresses, TLS Server Name Indication values, and any data sent over plain HTTP.
Researchers counted 520 extensions out of 522 analyzed that routed traffic through the same SOCKS5 infrastructure. Another 104 resolved proxy hostnames through Cloudflare or Google DNS-over-HTTPS. The technique helped shield the operator’s domains from easy scrutiny. (BleepingComputer)
Some extensions went further. They advertised premium servers located in Japan, Singapore, Canada, Australia and Turkey. Those hostnames resolved to no A records. The paid tiers never existed. The setup amounted to subscription fraud. Users who paid 99 roubles a month for an “EXTENSION” tier received nothing functional. The campaign also funneled victims toward a legitimate-sounding Russian subscription VPN service run by the same actor. Public records show the operator maintains a tax registration in Russia. (The Hacker News)
Code artifacts pointed to one build machine. File paths contained “C:\Users\ollob\OneDrive\Документы\1.myxa-work”. The name Myxa VPN, or Муха VPN in Russian, appeared in 360 popup strings. Internal notes in Russian instructed developers to supply only resolved IP addresses in chrome.proxy.settings and avoid listing domains. The instructions suggested deliberate efforts to evade store review policies.
Google acted after the disclosure. It removed 221 of the extensions. At the time of collection 516 remained live with 58,318 installs. Total campaign installs reached 75,486. Some extensions received code updates after initial approval. That let operators add the proxy configuration later. Others used shared analytics accounts and nearly identical code skeletons. One skeleton appeared in 50 live extensions alone. (TechRadar)
The findings arrived at a moment when browser-based privacy tools face growing skepticism. Extensions once offered lightweight alternatives to full VPN clients. Many users installed them without much thought. Free. Simple. Promising protection. Yet the trust model breaks when store listings lie about capabilities and destinations.
Kush Pandya, part of the Socket team, described the risk plainly. “The censorship circumvention extensions route the user’s entire browser session through SOCKS5 proxies operated by a single provider.” He added that 520 of the 522 extensions in the main set used the same infrastructure. In another statement he noted, “With all browser traffic forced through it [the relay], the threat actor’s server is positioned to read every destination, every TLS SNI value, the victim’s source IP, and any request body sent over plain HTTP.”
Another quote from Pandya drove the point home. “For each affected user, while the extension is connected, every request passes through a server the threat actor controls. If it resells, a further party is in the same position.”
These extensions didn’t encrypt traffic themselves. They relied on the SOCKS5 proxy. That left data exposed at the proxy layer. And the operator controlled that layer. No independent audit. No transparency report. Just a black box sitting between the user and the internet.
Recent coverage echoes the same alarm. A report published yesterday detailed how the campaign combined brand impersonation with technical evasion tactics. It noted the extensions often carried misleading store descriptions and fake reviews. (Bitdefender HotforSecurity)
Another analysis from two days ago highlighted the Russian focus and the link to a domestic VPN provider. It warned that users who installed these tools to regain access to blocked services may have traded one form of control for another. (Cyber Press)
Chrome users now face a practical problem. How do you know the extension you picked is legitimate? Visual similarity proves easy to fake. Store ratings can be manufactured. Permissions requests for proxy settings sound reasonable for a VPN tool. Yet they grant sweeping power.
Security teams recommend immediate action. Check the list of installed extensions. Look for anything promising free VPN or proxy access that mimics known brands. Remove suspicious ones. Reset proxy settings to default. If credentials were entered on non-HTTPS sites while the extension ran, change those passwords.
The episode exposes deeper weaknesses in the Chrome Web Store review process. Post-approval code changes slipped through. Nearly identical extensions from multiple accounts evaded detection for months. Shared infrastructure linked them all. Yet the store approved hundreds before researchers connected the dots.
Enterprise security leaders have taken notice. Many already block unvetted extensions by policy. This case strengthens the argument for tighter controls. Browser traffic represents sensitive data. Routing it through unknown proxies creates unacceptable exposure.
The operator appears to run a dual business. One side offers paid VPN subscriptions inside Russia. The other harvests traffic and data from users who thought they were bypassing censors for free. The overlap suggests a calculated approach. Build trust with a familiar brand name. Deliver the proxy. Collect the traffic. Monetize both ways.
Socket published the full list of extension IDs. Security teams can scan against it. Google continues to remove detected copies. Yet new variants could appear. The tactics are straightforward. Copy a logo. Write promising text. Request proxy permissions. Update the code later. Repeat across dozens of accounts.
This isn’t the first time fake VPN extensions have surfaced. It stands out for scale and coordination. Over 700 extensions. Tens of thousands of users. One infrastructure. Clear financial motive. The combination makes it hard to dismiss as isolated scams.
Browser vendors face pressure to improve. Stronger static analysis during review. Better detection of post-publication changes. Limits on proxy-related permissions for unverified publishers. Users, meanwhile, must become more cautious. The convenience of a one-click extension carries hidden costs when the wrong party holds the keys.
Privacy-conscious professionals already favor dedicated VPN applications with audited no-logs policies and independent testing. Browser extensions served a niche. That niche just shrank. The risk of handing your entire browsing session to an unknown Russian proxy operator outweighs any minor convenience.
The discovery serves as a reminder. Trust in the Chrome Web Store is not absolute. Verify before you install. Check permissions carefully. And when something promises free access to blocked services while wearing a famous brand’s name, look twice. The real cost could be far higher than 99 roubles a month.