Over 737 Fake Chrome VPN Extensions Routed Traffic Through SOCKS5 Proxies

Summary

Socket researchers found over 737 Chrome extensions impersonating VPN and proxy brands and routing traffic through one provider’s SOCKS5 proxies. Google removed over 200; more than 500 reportedly remain available.

Key points

The extensions impersonated established VPN and proxy brands and were linked to 40 publisher accounts and a shared analytics account.
The campaign’s extensions received nearly 75,000 downloads, mostly from Russian users seeking to bypass blocked services.
Researchers found 520 extensions configured Chrome to route browser traffic through the operator’s SOCKS5 proxies on port 1082.
Another 104 extensions used Cloudflare or Google DNS-over-HTTPS to resolve proxy hostnames.
The extensions also advertised nonexistent premium server locations and used other deceptive practices, including remote configuration added after approval.
Socket said the proxy operator could observe destinations, TLS SNI values, source IPs, and request bodies sent over plain HTTP.
Google removed over 200 extensions, but Socket said more than 500 remained available; it recommends checking for and removing identified extensions and restoring Chrome’s proxy settings.

Article Details

Event Type: A campaign of more than 737 fake Chrome extensions impersonated VPN and proxy brands while routing browser traffic through SOCKS5 proxies operated by a single provider.
Impact: The extensions were downloaded nearly 75,000 times, mostly by Russian users seeking to bypass blocked services. Socket researchers warned that routing traffic through the operator’s relay could expose destination information, TLS SNI values, users’ source IP addresses, and request bodies sent over plain HTTP. Based on strings they found, the researchers said the campaign appeared intended to funnel customers to a subscription-based VPN service in Russia; some extensions also advertised nonexistent premium server locations. Google removed more than 200 extensions, while the article reported that over 500 remained available.