Socket Links 737 Chrome VPN Extensions to Brand Impersonation and Traffic Redirection

Aug 11, 2026 · Original article ↗

Summary

Socket reports that 520 of 522 analyzed extensions routed browser traffic through shared SOCKS5 proxies. The campaign included 274 extensions impersonating 66 brands, and the investigation documented evasion, subscription fraud, and post-review code changes.

Key points

Socket identified 737 extensions published through at least 40 developer accounts; it retrieved and analyzed code from 522 of them.
520 analyzed extensions configured browser-wide traffic routing through shared SOCKS5 infrastructure on port 1082, putting the proxy operator in a position to observe destinations, source IPs, TLS SNI, and unencrypted HTTP content. Socket did not establish what the servers retained or transmitted.
A total of 274 extensions impersonated 66 established VPN and privacy brands, including AmneziaVPN and AntiZapret; the campaign primarily targeted Russian-speaking users.
104 extensions used DNS-over-HTTPS to resolve proxy hostnames and pass IP addresses to Chrome. Socket also found remote-configuration code added after store approval and identical reviewer statements denying external data transmission.
The advertised premium server hostnames tested by Socket did not resolve. One extension was configured so connection attempts always failed.
Socket linked the extension estate to a Myxa VPN subscription business through shared infrastructure and code. The research did not identify the individual operating the campaign or find evidence of state sponsorship.
Google had removed 221 extensions, while 516 were still listed as live when Socket collected its corpus. Socket recommends affected users remove campaign extensions, check Chrome proxy settings, and change credentials entered on non-HTTPS sites while connected.

Article Details

Attack Vectors: Free VPN and proxy extensions in the Chrome Web Store attracted users with privacy claims and, in 274 cases, impersonated established brands.
Once a user clicked Connect, 520 analyzed extensions configured Chrome to route browser traffic through a SOCKS5 proxy on port 1082, bypassing only loopback addresses.
Some extensions resolved proxy hostnames through DNS-over-HTTPS and configured Chrome with the resulting IP address rather than the hostname.
Sixty-six extensions followed redirects to discover a current campaign domain and retrieve remote configuration.
The advertised premium locations did not resolve in Socket's tests; one extension also had a connection handler hardcoded to fail.
Defensive Notes: Users should remove affected extensions, confirm Chrome's proxy configuration has returned to normal, and change credentials entered on non-HTTPS sites while an extension was connected.
Security teams should inventory extensions with proxy permission and alert on changes to chrome.proxy.settings.
Block identified campaign domains and proxy IPs at DNS and egress. DNS blocking alone does not address extensions that resolve hosts through DNS-over-HTTPS and configure raw IPs.
Review extension code changes as well as permissions: one documented post-approval update added remote configuration without changing its permission set.
Socket observed extension behavior and public infrastructure, but did not determine what proxy servers retained or transmitted, or verify operation of the separate paid VLESS-REALITY tier.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`atlasvpn[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`bezopasnet[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`cipherway[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`cloudmask[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`echosecure[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`getmyxa[.]com`	Domain listed as campaign infrastructure.
DOMAIN	`gusentun[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`gusenvpn[.]online`	Domain listed as campaign network infrastructure.
DOMAIN	`horizonguard[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`internetprvpn[.]ru`	Domain listed as campaign network infrastructure.
DOMAIN	`ironproxy[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`korovkavpn[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`maskirovka[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`murvpn[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`myxasafe[.]space`	Campaign domain discovered by following runtime redirects.
DOMAIN	`myxasecure[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`myxavpn[.]com`	Campaign operator domain listed as infrastructure.
DOMAIN	`myxavpn[.]online`	Campaign domain discovered by following runtime redirects.
DOMAIN	`myxavpn[.]pro`	Campaign operator's commercial storefront and subscription business.
DOMAIN	`myxavpn[.]site`	Campaign domain discovered by following runtime redirects.
DOMAIN	`myxavpn[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`myxavpn[.]tech`	Campaign domain discovered by following runtime redirects.
DOMAIN	`neoncloak[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`netroutehub[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`nimbusshield[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`osavpn[.]su`	Domain listed as campaign network infrastructure.
DOMAIN	`pauktun[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`primeproxy[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`routekeeper[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`routeshield[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`salega[.]ru`	Domain listed as campaign network infrastructure.
DOMAIN	`securepulse[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`shershvpn[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`shieldtunnel[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`silashield[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`skorostvpn[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`skyproxy[.]space`	Project domain in a build manual shipped inside a campaign extension.
DOMAIN	`spidervpn[.]online`	Domain listed as campaign network infrastructure.
DOMAIN	`stableproxy[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`stealthpath[.]space`	Campaign proxy domain used in the published server-resolution example.
DOMAIN	`sverchtun[.]store`	Campaign proxy domain that the article says still resolves.
DOMAIN	`sverchvpn[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`tarakanvpn[.]online`	Domain listed as campaign network infrastructure.
DOMAIN	`tunnelbase[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`turbotunnel[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`usachvpn[.]su`	Domain listed as campaign network infrastructure.
DOMAIN	`vaultvpn[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`vpn-myxa[.]ru`	Domain listed as campaign network infrastructure.
DOMAIN	`vpnfasters[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`vpnkomar[.]space`	Campaign landing domain linked to the storefront by a shared analytics counter.
DOMAIN	`vpnmyha[.]shop`	Campaign landing domain linked to the storefront by a shared analytics counter.
DOMAIN	`vpnmyxa[.]site`	Campaign landing domain linked to the storefront by a shared analytics counter.
DOMAIN	`zenshield[.]space`	Domain listed as campaign network infrastructure.
DOMAIN	`zhuknet[.]online`	Domain listed as campaign network infrastructure.
DOMAIN	`zhukvpn[.]online`	Domain listed as campaign network infrastructure.
HOSTNAME	`app[.]getmyxa[.]com`	Host listed as campaign infrastructure.
HOSTNAME	`app[.]myxavpn[.]com`	Host listed as campaign infrastructure.
HOSTNAME	`app[.]myxavpn[.]pro`	Campaign operator's billing dashboard.
HOSTNAME	`au[.]stealthpath[.]space`	Advertised premium proxy hostname that returned no DNS answer.
HOSTNAME	`de[.]stealthpath[.]space`	Resolving free-tier hostname in a campaign extension's proxy-server list.
HOSTNAME	`fr[.]stealthpath[.]space`	Resolving free-tier hostname in a campaign extension's proxy-server list.
HOSTNAME	`gb[.]stealthpath[.]space`	Resolving free-tier hostname in a campaign extension's proxy-server list.
HOSTNAME	`git[.]myxavpn[.]com`	Campaign operator's self-managed source-control host.
HOSTNAME	`jp[.]stealthpath[.]space`	Advertised premium proxy hostname that returned no DNS answer.
HOSTNAME	`monitoring[.]myxavpn[.]com`	Campaign operator's Grafana monitoring host.
HOSTNAME	`nl[.]stealthpath[.]space`	Resolving free-tier hostname in a campaign extension's proxy-server list.
HOSTNAME	`sg[.]stealthpath[.]space`	Advertised premium proxy hostname that returned no DNS answer.
HOSTNAME	`sub[.]myxasecure[.]space`	Paid-tier subscription domain exposed by the campaign billing dashboard; node operation was not verified.
HOSTNAME	`tr[.]stealthpath[.]space`	Advertised premium proxy hostname that returned no DNS answer.
HOSTNAME	`us[.]stealthpath[.]space`	Resolving free-tier hostname in a campaign extension's proxy-server list.
HOSTNAME	`xray[.]myxavpn[.]com`	Campaign operator's earlier VPN-service infrastructure.
IPV4	`103[.]35[.]189[.]225`	IP listed among campaign network indicators.
IPV4	`103[.]35[.]191[.]173`	IP listed among campaign network indicators.
IPV4	`130[.]17[.]1[.]19`	IP listed among campaign network indicators.
IPV4	`138[.]124[.]244[.]206`	IP listed among campaign network indicators.
IPV4	`147[.]45[.]60[.]241`	IP listed among campaign network indicators and returned for a free-tier proxy hostname.
IPV4	`147[.]45[.]60[.]252`	IP listed among campaign network indicators.
IPV4	`158[.]160[.]228[.]178`	IP listed with the campaign billing dashboard in the network indicators.
IPV4	`178[.]130[.]47[.]129`	IP listed among campaign network indicators.
IPV4	`178[.]130[.]47[.]43`	IP listed among campaign network indicators and returned for a free-tier proxy hostname.
IPV4	`178[.]130[.]47[.]44`	IP listed among campaign network indicators and returned for a free-tier proxy hostname.
IPV4	`178[.]130[.]47[.]50`	IP listed among campaign network indicators and returned for a free-tier proxy hostname.
IPV4	`185[.]252[.]215[.]97`	IP listed among campaign network indicators and returned for a free-tier proxy hostname.
IPV4	`185[.]252[.]215[.]98`	IP listed among campaign network indicators and returned for a free-tier proxy hostname.
IPV4	`194[.]150[.]220[.]163`	IP listed among campaign network indicators and returned for a free-tier proxy hostname.
IPV4	`212[.]192[.]14[.]75`	Host resolving multiple campaign domains; reverse-IP results exposed additional campaign domains.
IPV4	`45[.]89[.]110[.]227`	IP listed among campaign network indicators and returned for a free-tier proxy hostname.
IPV4	`5[.]180[.]30[.]122`	IP listed among campaign network indicators and returned for a free-tier proxy hostname.
IPV4	`5[.]180[.]30[.]15`	IP listed among campaign network indicators and returned for a free-tier proxy hostname.
IPV4	`78[.]153[.]155[.]112`	IP listed among campaign network indicators.
IPV4	`80[.]92[.]204[.]33`	IP listed among campaign network indicators and returned for a free-tier proxy hostname.
IPV4	`80[.]92[.]204[.]47`	IP listed among campaign network indicators and returned for a free-tier proxy hostname.
IPV4	`80[.]92[.]206[.]84`	IP listed among campaign network indicators and returned for a free-tier proxy hostname.
IPV4	`81[.]90[.]31[.]73`	IP listed among campaign network indicators.
IPV4	`86[.]104[.]74[.]110`	IP listed among campaign network indicators and returned for a free-tier proxy hostname.
IPV4	`94[.]131[.]118[.]237`	IP listed among campaign network indicators and returned for a free-tier proxy hostname.
IPV4	`94[.]131[.]118[.]39`	IP listed among campaign network indicators and returned for a free-tier proxy hostname.
IPV4	`95[.]163[.]244[.]138`	IP listed among campaign network indicators.
URL	`hxxps[:]//t[.]me/myxavpn_bot`	Telegram bot link opened by a campaign extension on first installation.