737 Chrome VPN Extensions Hijack Browser Traffic Through SOCKS5 Proxies

Socket researchers identified 737 Chrome VPN and proxy extensions linked to a coordinated campaign that accumulated 75,486 installs. The extensions impersonate 66 established VPN and privacy brands and use Chrome's proxy settings to route browser traffic through shared SOCKS5 infrastructure, potentially placing attackers in an adversary-in-the-middle position.