737 Chrome VPN Extensions Caught Routing Traffic Through Proxies: What You Need to Know

A massive operation involving 737 free VPN and proxy extensions on the Chrome Web Store has been uncovered, primarily targeting Russian-speaking users seeking to bypass censorship. The extensions, distributed across at least 40 developer accounts, amassed 75,486 installs. Security firm Socket identified that 274 of these extensions impersonate 66 established VPN and privacy brands, including Proton VPN, NordVPN, Surfshark, AdGuard VPN, Browsec, ExpressVPN, CyberGhost, Windscribe, TunnelBear, Cloudflare’s 1.1.1.1, and Google’s Outline.

Researcher Kush Pandya revealed that the extensions route users’ entire browser sessions through SOCKS5 proxies operated by a single provider, placing the threat actor in an adversary-in-the-middle (AitM) position. This allows them to observe browser destinations, source IP addresses, TLS SNI values, and any plain HTTP request bodies. The extensions set ‘chrome.proxy.settings’ to a fixed SOCKS5 server on port 1082, with a bypass list containing only loopback addresses, funneling all other traffic through the proxy.

Of the 737 extensions, 221 have been removed from the Chrome Web Store, while 516 remain active. The threat actor appears to run a subscription VPN business in Russia, based on a 12-digit taxpayer number and leaked Windows build paths. Red flags include advertising non-existent premium tiers, DNS-over-HTTPS blocklist evasion, fake interfaces with working animations, and deliberate attempts to evade Chrome Web Store policies, including post-approval code substitution.

In a related development, Netskope Threat Labs reported the return of a Chrome extension named ‘AI Sidebar with Deepseek, ChatGPT, Claude, and more.’ After being removed for prompt poaching, it resurfaced with a monetization scheme that opens affiliate links in foreground tabs on update and uninstall events, while suppressing redirection of DeepSeek users to ChatGPT.

Users are advised to check their installed extensions and remove any suspicious ones immediately.