CTI · reviewed · 2026-09-29

Fake Chrome VPN Extensions Hijack Browser Traffic Through Russian Proxy Network

Full story & timeline

MITRE ATT&CK

• T1176 Software Extensions Persistence
• T1090 Proxy Command and Control
• T1557 Adversary-in-the-Middle Credential Access

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Malicious Fake VPN Chrome Extension Installation
id: d8b6b8e6-9e97-4d2e-af26-db256380f57c
status: experimental
description: >
    Detects installation or update of the malicious RuTracker VPN Chrome
    extension (ID llngkcnndicadfcbikbjnhbcikpmaknj) from the cluster of 31
    linked fake VPN extensions disclosed by Risky Plugins (September 2026)
    that reroute browser traffic through a remotely controlled residential
    proxy network; the same codebase ships under many other names, so
    matching on the extension ID in the profile directory catches the whole
    cluster member sampled here.
references:
    - https://gbhackers.com/malicious-vpn-extensions/
    - https://cyberpress.org/fake-chrome-vpn-extensions-hijack-browser-traffic/
author: Tia N. List
date: 2026/09/29
tags:
    - attack.t1176
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|contains: '\Extensions\llngkcnndicadfcbikbjnhbcikpmaknj\'
    condition: selection
falsepositives:
    - Unlikely unless the sample is deliberately installed for research;
      sibling extensions from the same cluster use different IDs and will
      not match this rule
level: high

References

• https://cyberpress.org/fake-chrome-vpn-extensions-hijack-browser-traffic/
• https://gbhackers.com/malicious-vpn-extensions/