Fake Proton VPN and NordVPN Chrome Extensions Route Users Through Unrelated Proxy Network
Brief
A large network of fake Chrome VPN extensions impersonating trusted brands such as Proton VPN and NordVPN has been found routing users’ browser traffic through a separate SOCKS5 proxy network.
Socket’s Threat Research Team identified 737 free VPN and proxy extensions linked to at least 40 Chrome Web Store developer accounts.
Of these, 274 extensions impersonated 66 well-known VPN and privacy brands, including Proton VPN, NordVPN, Surfshark, ExpressVPN, Cloudflare 1.
- 1. 1, AmneziaVPN, and AntiZapret.
The campaign had accumulated 75,486 displayed installs, while 516 extensions remained live with 58,318 installs at the time of collection.
The operation mainly targets Russian-speaking users trying to access blocked services such as Instagram, ChatGPT, and YouTube. Many listings used Cyrillic names and descriptions, while promising privacy, IP masking, and unrestricted access.