Hackers Behind Fake VPN Extensions Exposed, Thousands of Users Affected
A massive campaign to deceive users has been uncovered by researchers at Socket, with over 737 fake Chrome browser extensions impersonating well-known VPN and proxy services. These extensions were downloaded nearly 75,000 times from the Chrome Web Store, primarily by Russian users seeking tools to bypass blocked services in their country.
The scheme relied on 40 publisher accounts and a shared analytics account, using a single provider’s SOCKS5 proxies to route user traffic through. This allowed the threat actors to intercept and read every destination, TLS SNI value, source IP, and request body sent over plain HTTP. The researchers identified three key behaviors associated with the campaign: forcing all browser traffic through the operator’s proxies, resolving proxy hostnames to protect the operator’s domain from scrutiny, and advertising non-existent premium servers for subscription fraud.
The extensions’ code appears no different from that of legitimate services, but several indicators of intentional deception were identified. These include impersonating well-known brands, advertising nonexistent server locations, and using misleading disclosures to reviewers. Furthermore, some extensions added remote configuration after being approved, while others used techniques to hide proxy destinations from analysis.
While Google removed over 200 related extensions, more than 500 remain available in the Chrome Web Store. Socket has published the IDs of all extensions linked to the campaign, urging users to check their browsers for any of them and remove them if found. It’s also essential to confirm that Chrome’s proxy configuration is back to normal.
This incident highlights the importance of being cautious when downloading browser extensions from online stores. Users must be aware of the potential risks associated with third-party add-ons and verify the authenticity of services before subscribing or using them. By doing so, individuals can protect themselves from falling victim to these types of scams.
In addition to removing the affected extensions, users should also consider reviewing their browser settings and proxy configurations regularly to ensure they are not being exploited by malicious actors. This vigilance is crucial in preventing similar campaigns from succeeding in the future.
Source: Bleeping Computer — 2026-08-12