Security researchers have uncovered a large campaign involving 737 Chrome VPN and proxy extensions that impersonated legitimate privacy and VPN brands and secretly redirected browser traffic through SOCKS5 proxy infrastructure.
The extensions primarily targeted Russian-speaking users looking for ways to access blocked services. Together, the extensions accumulated 75,486 installs and were distributed through at least 40 Chrome Web Store developer accounts.
Key Highlights
- 737 Chrome VPN and proxy extensions identified.
- More than 75,000 total installs.
- 274 extensions impersonated 66 established VPN and privacy brands.
- 520 of 522 analyzed extensions routed browser traffic through the same SOCKS5 infrastructure.
- SOCKS5 proxies were configured on port 1082.
- The extensions could place the proxy operator in an Adversary-in-the-Middle (AitM) position.
- 221 extensions had been removed from the Chrome Web Store.
- 516 extensions remained active when the research was conducted.
- Some extensions used fake premium VPN server listings.
- Researchers found evidence of attempts to evade Chrome Web Store review.
- A subset used DNS-over-HTTPS to make proxy infrastructure harder to block.
Brand Impersonation
The campaign used extensions designed to resemble legitimate VPN and privacy services.
Researchers identified 274 extensions impersonating 66 established brands, including:
- Proton VPN
- NordVPN
- Surfshark
- ExpressVPN
- CyberGhost
- Windscribe
- TunnelBear
- AdGuard VPN
- Browsec
- Cloudflare 1.1.1.1
- Google Outline
The impersonation was intended to make the extensions appear trustworthy to users searching for VPN and censorship-circumvention tools.
Browser Traffic Redirection
The primary malicious behavior involved modifying Chrome's proxy configuration through:
chrome.proxy.settings
The extensions configured SOCKS5 proxy servers and routed almost all browser traffic through the infrastructure.
The proxy configuration used port 1082 and excluded only local loopback addresses such as localhost and 127.0.0.1.
As a result, normal browser requests could be redirected through infrastructure controlled or selected by the campaign operators.
Potential Information Exposure
While the extensions were connected, the proxy operator could potentially observe:
- Source IP addresses
- Destination hosts
- TLS SNI information
- HTTP request contents
- Browser traffic metadata
- Websites visited
The research does not establish exactly what information was logged or retained by the proxy servers.
However, routing traffic through an undisclosed third-party proxy creates a significant privacy and security risk.
DNS-over-HTTPS Evasion
A subset of 104 extensions attempted to make their proxy infrastructure more difficult to identify or block.
These extensions used DNS-over-HTTPS services from providers such as Google and Cloudflare to resolve proxy hostnames.
The resulting IP addresses were then supplied to Chrome's proxy configuration.
This approach reduced the visibility of normal DNS queries for the campaign's proxy domains.
Fake Premium VPN Infrastructure
Researchers also identified fake premium server infrastructure.
The extensions advertised VPN locations in countries including:
- Japan
- Singapore
- Canada
- Australia
- Turkey
However, testing of 200 premium hostnames across 40 domains found that none returned an A record.
This indicates that the advertised premium infrastructure was not operational as represented.
Chrome Web Store Evasion
Researchers identified several indicators suggesting deliberate attempts to bypass Chrome Web Store security controls.
These included:
- Identical justifications submitted during extension review
- False claims that no data was transmitted externally
- Attempts to avoid directly exposing proxy domains
- Post-approval remote configuration mechanisms
- Comments indicating attempts to evade Chrome Web Store policies
- Code substitutions after extensions received approval
Campaign Infrastructure
Researchers linked the extensions using multiple infrastructure and development artifacts.
Evidence included:
- Shared analytics identifiers
- Common hosting infrastructure
- Similar code-generation markers
- Synchronized domain registrations
- Shared proxy infrastructure
- Leaked Windows build paths
Some build artifacts referenced a project directory associated with Myxa VPN / Муха VPN.
The infrastructure was linked to a Russian VPN subscription business.
Detection and Hunting Opportunities
Security teams should monitor for:
- Unauthorized Chrome extensions
- Newly installed VPN or proxy extensions
- Extensions modifying
chrome.proxy.settings - SOCKS5 connections to unusual external infrastructure
- Outbound connections to TCP/1082
- Browser traffic being routed through unexpected proxy servers
- Chrome extensions impersonating known VPN brands
- Extensions containing remote configuration functionality
- DNS-over-HTTPS requests associated with proxy infrastructure
- Unexpected changes to Chrome proxy settings
- Suspicious extension developer accounts
- Browser traffic suddenly originating from unfamiliar IP addresses
Recommended Mitigations
- Audit installed Chrome extensions across the organization.
- Remove unauthorized VPN and proxy extensions.
- Restrict extension installation to approved Chrome Web Store applications.
- Monitor enterprise Chrome policies and extension installation events.
- Monitor for modifications to Chrome proxy settings.
- Investigate unexpected SOCKS5 connections, particularly TCP/1082.
- Block known malicious extension IDs and associated infrastructure where available.
- Review browser traffic for unexpected proxy routing.
- Rotate credentials entered through non-HTTPS websites while an affected extension was active.
- Treat browsing activity during the affected period as potentially exposed.
- Use enterprise browser security controls to prevent unauthorized extensions.
Impact Assessment
The campaign represents a significant browser privacy and security risk because users intentionally installed the extensions believing they were legitimate VPN or privacy tools.
By secretly routing browser traffic through third-party SOCKS5 infrastructure, the extensions could provide the proxy operator with visibility into users' browsing activity and potentially unencrypted HTTP content.
The combination of brand impersonation, undisclosed proxy configuration, fake premium infrastructure and Chrome Web Store evasion makes this campaign particularly concerning for enterprise environments.
Conclusion
Organizations should treat unauthorized browser VPN extensions as a potential security risk rather than simply a privacy concern.
Enterprise administrators should audit Chrome extensions, enforce allowlists where possible, monitor browser proxy configuration changes and investigate unusual SOCKS5 traffic.
Users who installed affected extensions should remove them, verify that Chrome proxy settings have returned to normal and rotate credentials that may have been transmitted through unencrypted HTTP connections.