A sprawling network of 737 fraudulent VPN and proxy extensions has been discovered on the Chrome Web Store, primarily targeting Russian-speaking users attempting to access blocked services, according to a report published by Socket. The extensions, distributed across at least 40 Chrome Web Store developer accounts, accumulated 75,486 installations. The operation routed users' entire browser sessions through a proxy infrastructure controlled by a single threat actor, placing them in a position to intercept traffic and observe user activity.
Of the 737 extensions identified, 274 impersonated 66 well-known VPN and privacy brands, including Proton VPN, NordVPN, Surfshark, AdGuard VPN, Browsec, ExpressVPN, CyberGhost, Windscribe, TunnelBear, Cloudflare's 1.1.1.1, and Google's Outline. The majority of the extensions—520 out of 522 in the bulk corpus—funneled browser traffic through identical SOCKS5 infrastructure on port 1082. As of the report's publication, 221 browser add-ons had been removed from the Chrome Web Store, while the remaining 516 extensions were still listed as active. The threat actor is believed to be operating a subscription VPN business in Russia, based on a 12-digit taxpayer number and leaked Windows build paths referencing Russian text.
Security researcher Kush Pandya explained that the extensions route users' complete browser sessions by configuring "chrome.proxy.settings" to a fixed SOCKS5 server on port 1082, positioning the threat actor in an adversary-in-the-middle stance to monitor browser destinations, source IP addresses, TLS SNI values, and any request body transmitted over plain HTTP. According to the report, every extension configuring a proxy includes a bypass list containing only loopback addresses like localhost or 127.0.0.1, meaning all other browser requests are channeled through the SOCKS5 relay once users connect to the supposed VPN service. "For each affected user, while the extension is connected, every request passes through a server the threat actor controls," Pandya stated.
The report highlights several red flags distinguishing this operation from legitimate services, including advertising paid tiers and premium locations that don't actually exist, DNS-over-HTTPS blocklist evasion, and showing fake interfaces that display working connection animations and status indicators while failing every connection attempt. The extensions also shipped an internal manual titled "Промт для сотрудников" (translated as "Prompt for employees") instructing workers to avoid putting the domain directly into proxy settings and instead provide only the resolved IP address. The threat actor attempted to game the Chrome Web Store review process by submitting identical justifications claiming "No data transmitted to external servers" or "No user tracking or logging," then adding a new remote-configuration layer after extension approval. The report establishes the impersonation, undisclosed proxy configuration, non-existent premium servers, false statements submitted to store reviewers, and post-approval code substitution.
The defining characteristic of this activity is its attempt to impersonate established brands rather than offering services under the operator's own name, even though the core functionality mirrors that of legitimate VPN or proxy services. The scope of the operation—spanning hundreds of extensions and dozens of developer accounts—demonstrates a systematic effort to capture users seeking censorship circumvention tools. For organizations and individual users, the discovery underscores the risk of trusting browser extensions based on brand recognition alone, particularly when seeking privacy tools in regions with internet restrictions. Enterprise security teams may need to reconsider how they vet and approve browser extensions, especially those claiming to provide VPN or proxy services that could position an external party to observe all corporate web traffic.