**Majority of Free VPN Browser Extensions Found to be Fraudulent Infrastructure Scams**
A massive set of 737 free VPN and proxy extensions has been identified on the Chrome Web Store, primarily targeting Russian-speaking users seeking access to blocked services. Security analysis reveals these extensions are designed to intercept browser traffic and route it through a proxy infrastructure, often while impersonating established, trusted brands.
The extensions, published across at least 40 different developer accounts, accumulated a concerning 75,486 installs before being flagged. Security researcher Kush Pandya, working with security firm Socket, identified 274 extensions that actively impersonate 66 legitimate VPN and privacy brands. This list includes household names like Proton VPN, NordVPN, Surfshark, AdGuard VPN, Browsec, ExpressVPN, CyberGhost, Windscribe, TunnelBear, and even privacy-focused tools like Cloudflare’s 1.1.1.1 and Google’s Outline.
The core functionality of these malicious extensions is sophisticated and dangerous. They route the user’s entire browser session through SOCKS5 proxies controlled by a single threat actor. An analysis of 522 extensions in a bulk corpus found that 520 of them utilized the same SOCKS5 infrastructure. To maintain this control, they configure the browser’s proxy settings to point to a fixed SOCKS5 server on port 1082. This setup places the threat actor in an **adversary-in-the-middle (AitM)** position, allowing them to observe a vast amount of user data, including:
* Browser destinations (websites visited)
* Source IP addresses
* TLS Server Name Indication (SNI) values
* Any request body sent over unencrypted HTTP
Furthermore, the extensions employ a bypass list that only includes loopback addresses (like 127.0.0.1). This ensures that after the local bypass, **every single other browser request is funneled through the attacker’s SOCKS5 relay** once the user believes they are connected to a legitimate VPN service.
Of the 737 extensions identified, 221 have been removed from the Chrome Web Store. However, 516 remain active, posing an ongoing threat. The scale of the operation suggests a sophisticated criminal enterprise. Indicators point to a subscription-based VPN business operating out of Russia. This is supported by the discovery of a 12-digit taxpayer number within the extension code, as well as Windows build paths that inadvertently leak internal development directory structures.
**Red Flags and Deceptive Tactics**
The malicious extensions are engineered to mimic the experience of a legitimate service while hiding their true nature. Several key red flags have been identified:
* **False Premium Features:** They advertise paid tiers or premium server locations that do not actually exist.
* **DNS-over-HTTPS (DoH) Blocklist Evasion:** They attempt to bypass security measures designed to block malicious DNS traffic.
* **Fake User Interface:** They fail every connection attempt but display a complete, convincing fake interface, complete with a working “connecting” animation and status indicator to fool the user.
* **Internal Evasion Manuals:** They ship with internal manuals (one titled “Prompt for employees” in Russian) that instruct employees on how to evade Chrome Web Store policies, specifically by not using a domain directly in the proxy settings code and instead providing a resolved IP address.
* **Post-Approval Updates:** They add a remote-configuration layer that activates after the extension has been approved and published in the store.
* **Review Game Playing:** They submit identical justifications to reviewers, containing statements like “No data transmitted to external servers” or “No user tracking or logging,” despite the exact opposite being true.
**A Pattern of Evasion: From VPN Scams to Prompt Poaching**
This discovery is part of a larger trend of malicious actors abusing the Chrome Web Store. The report notes the reappearance of a Chrome extension named “AI Sidebar with Deepseek, ChatGPT, Claude, and more.” This extension was previously removed for “prompt poaching”—stealing proprietary AI prompts—from users. It returned with a “clean-then-poisoned” update sequence. This new version removed the data theft code only to introduce a monetization scheme that opens an affiliate link in a foreground browser tab every time the extension updates or is uninstalled, adding another layer of deceptive monetization.
—
### FAQ
**Q: How can I protect myself from these fake VPN extensions?**
**A:** The best protection is to be highly skeptical of free VPNs. Only download and use extensions from sources you trust implicitly. It is safer to use reputable, well-audited VPN services from established companies rather than random extensions from the Chrome Web Store. Always check the developer’s other projects and online reputation before installing.
**Q: What are the signs that a VPN extension might be malicious?**
**A:** Major red flags include:
* An extension that claims to offer premium features for free that normally cost money.
* An extension that asks for extensive and unnecessary permissions (like “Read all data on websites you visit”).
* An extension from a developer with a low profile or a history of suspicious activity.
* Generic or poorly written descriptions and a lack of a proper privacy policy on its store page.
**Q: What should I do if I have one of these extensions installed?**
**A:** You should uninstall it immediately. Go to your Chrome browser settings, navigate to “Extensions,” find the suspicious VPN or proxy extension, and click “Remove.” After removal, it is recommended to clear your browser cache and cookies. You should also change passwords for any sensitive accounts accessed while the extension was active, as your traffic may have been intercepted.
**Q: Why are Russian-speaking users specifically targeted?**
**A:** The primary targets are Russian-speaking users because they often seek tools to bypass government-imposed internet censorship and access services blocked within Russia. This high demand creates a large pool of potential victims for these scams.
—
### Conclusion
The discovery of 737 fake VPN extensions highlights a critical vulnerability in the Chrome Web Store’s ecosystem. What makes this case particularly insidious is not just the theft of bandwidth, but the sophisticated man-in-the-middle attack it facilitates. By impersonating trusted brands and maintaining complete control over the user’s browser traffic, the threat actor could potentially intercept any unencrypted data or even compromise the security of encrypted connections. This serves as a stark reminder that convenience often comes with a cost, and users must prioritize security and privacy by vetting extensions thoroughly before installing them. The line between a helpful tool and a sophisticated spy tool can be surprisingly thin.
