cyber.hendryadrian.com
Security News · thehackernews.com

Researchers Find 737 Chrome VPN Extensions Routing Traffic Through SOCKS5 Proxies

· Original article ↗

Summary

Researchers found 737 free VPN and proxy extensions impersonating brands; 520 of 522 in a bulk corpus routed traffic through shared SOCKS5 infrastructure. Separately, a returned AI Sidebar extension added affiliate-link monetization.

Key points

  • The 737 extensions had 75,486 installs across at least 40 Chrome Web Store developer accounts; 274 impersonated 66 established privacy and VPN brands.
  • Researchers said 520 of 522 extensions in the bulk corpus routed browser traffic through the same SOCKS5 infrastructure.
  • The proxy configuration could let operators observe browser destinations, source IP addresses, TLS SNI values, and request bodies sent over plain HTTP.
  • A total of 221 extensions had been removed from the Chrome Web Store; the remaining 516 were listed as active.
  • The article reports that a previously removed AI Sidebar extension returned with a payload that opens an affiliate link when the extension updates or uninstalls.
  • The AI Sidebar extension no longer contained the reported conversation-exfiltration code, but its new update also suppressed DeepSeek users' redirection to ChatGPT.

Article Details

Event Type
Malicious Chrome extensions impersonated VPN and privacy brands to route browser traffic through SOCKS5 proxies; a previously removed AI Sidebar extension returned with affiliate-link monetization behavior.
Impact
The article reports 737 VPN and proxy extensions with 75,486 installs, primarily targeting Russian-speaking users. The extensions routed browser sessions through proxy infrastructure described as attacker-controlled, potentially exposing destinations, source IP addresses, TLS SNI values, and plain-HTTP request bodies. 221 extensions were removed from the Chrome Web Store, while 516 were reported active. Separately, the AI Sidebar extension's update and uninstall events opened affiliate links in a foreground tab; the article says its earlier conversation-exfiltration code was no longer present.

People

Kush PandyaSecurity researcher who described the extensions' use of SOCKS5 proxies and the resulting visibility into affected users' browser requests.

Vendors

GoogleAdGuard VPN, Browsec, ExpressVPN, CyberGhost, Windscribe, TunnelBear, Cloudflare’s 1.1.1.1, and Google’s Outline, per Socket.

Products

AI Sidebar with DeepSeek AISeparately, the Chrome extension “AI Sidebar with Deepseek, ChatGPT, Claude, and more” resurfaced with a new monetization payload after a prior removal, showing how malicious updates can shift from data theft toChrome Web StoreMany extensions were removed from the Chrome Web Store, while hundreds remained active.Google ChromeSeparately, the Chrome extension “AI Sidebar with Deepseek, ChatGPT, Claude, and more” resurfaced with a new monetization payload after a prior removal, showing how malicious updates can shift from data theft to

Countries

RussiaThe threat actor is said to be running a subscription VPN business in Russia, based on a 12-digit taxpayer number and the fact that some of them leak their Windows build path

Related Articles