More than 737 Chrome Web Store extensions impersonated major VPN and proxy brands while secretly routing user traffic through SOCKS5 proxies controlled by a single provider. The campaign, linked to 40 publisher accounts and nearly 75,000 downloads, used deceptive tactics to push users toward a likely subscription-based VPN service in Russia. #ProtonVPN #NordVPN #Surfshark #ExpressVPN #Cloudflare #ChromeWebStore
Keypoints
- More than 737 Chrome extensions impersonated trusted VPN and proxy services.
- The extensions routed traffic through SOCKS5 proxies operated by one provider.
- The campaign used 40 publisher accounts and a shared analytics account.
- Nearly 75,000 downloads came mostly from Russian users seeking to bypass blocked services.
- Google removed over 200 extensions, but more than 500 still remain available.