737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One
Researchers found 737 Chrome VPN extensions, many impersonating brands like NordVPN, routing roughly 75,000 users' browser traffic through attacker-controlled SOCKS5 proxies.
Socket and researcher Kush Pandya identified 737 Chrome VPN and proxy extensions, published across at least 40 developer accounts with 75,486 installs, that route entire browser sessions through one provider's SOCKS5 proxies on port 1082. Of these, 274 impersonate 66 established brands including Proton VPN, NordVPN, Surfshark, ExpressVPN, and Cloudflare 1.1.1.1. The proxy bypass list only excludes loopback addresses, exposing visited destinations, source IPs, TLS SNI values, and plain-HTTP request bodies to the operator. 221 extensions have been removed from the Chrome Web Store while 516 remain listed as active.
- Extensions set chrome.proxy.settings to a fixed SOCKS5 server on port 1082, creating an adversary-in-the-middle position.
- 274 add-ons impersonate 66 brands including Proton VPN, NordVPN, Surfshark, AdGuard VPN, and TunnelBear.
- Actor linked to a Russian subscription VPN business via a taxpayer number and leaked Windows build paths.
- Red flags include nonexistent premium tiers, fake connection interfaces, and policy-evasion comments.
- Netskope reports the removed 'AI Sidebar' extension returned with a monetization payload triggered on update and uninstall events.
- Malware
- AI Sidebar
- Organizations
- Netskope
- Countries
- Russia
From the original article
3 min read at thehackernews.com
Ravie Lakshmanan Aug 12, 2026 Browser Security / Privacy A massive set of 737 free VPN and proxy extensions have been found to mainly target Russian-speaking users seeking access to blocked services with an aim to intercept browser traffic and route them through a proxy infrastructure. The extensions, published across at least 40 Chrome Web Store developer accounts, racked up 75,486 installs.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.