Hundreds of fake Chrome VPN extensions route traffic through a proxy
Over 737 fake Chrome VPN extensions were found to route user traffic through a single provider's proxy.
Hundreds of malicious Chrome extensions disguised as popular VPN services have been discovered on the Chrome Web Store, collectively downloaded nearly 75,000 times. These extensions secretly route user traffic through SOCKS5 proxies operated by a single provider, potentially exposing sensitive data. The campaign appears to be an effort to funnel users towards a Russian subscription-based VPN service, with some extensions also engaging in subscription fraud.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonHundreds of counterfeit Chrome extensions impersonating legitimate VPN services were published to the Chrome Web Store and downloaded nearly 75,000 times before discovery. These extensions silently rerouted user traffic through attacker-controlled SOCKS5 proxies, exposing potentially sensitive browsing data and enabling subscription fraud. The attack exploits user trust in both well-known VPN brands and the perceived legitimacy of the official Chrome Web Store marketplace. This matters because users typically assume that extensions hosted on official stores have been vetted, making supply chain-style abuse of app marketplaces a highly effective social engineering vector.
What helps against this
How we list vendors
- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — fake Chrome VPN extensions