737 Fake Chrome VPN Extensions Hijack Browser Traffic Through Attacker-Controlled SOCKS5 Proxies
Brief
Hundreds of Chrome extensions advertised as free VPN or proxy tools have been tied to a large traffic-redirection operation.
The listings promised privacy and access to blocked services, but their code sent browser sessions through SOCKS5 proxy servers controlled by the operation.
The scale makes the discovery especially concerning. Researchers counted 737 extensions published through at least 40 Chrome Web Store developer accounts, with more than 75,000 combined installs.
Many were aimed at Russian-speaking users looking for access to restricted sites and services.
Analysts at Socket.dev identified the campaign after examining hundreds of available extension packages and store listings.