737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection
Brief
Socket's Threat Research Team identified a campaign of 737 free VPN and proxy extensions published across at least 40 Chrome Web Store developer accounts, 274 of which impersonate 66 established VPN and privacy brands, that route the user's entire browser session through SOCKS5 proxies operated by a single provider.
Socket analyzed the code of 525 of them, 522 from bulk retrieval and 3 more found during store enumeration; the remaining 212 had been removed from the store before collection and were recovered at listing level only. 520 of the 522 in the bulk corpus route browser traffic through the same SOCKS5 infrastructure.
The campaign has accumulated 75,486 installs across 737 extensions, of which 516 were listed as active when the corpus was collected, carrying 58,318 installs.