Reported by 2 outlets
Fake Chrome VPN Extensions Hijack Browser Traffic Through Russian Proxy Network
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.59 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
A Russian-language proxy network operates through 31 linked Chrome extensions marketed as free VPN tools for individual services such as YouTube, Telegram, Instagram, ChatGPT, Claude, Gemini, Netflix, Discord, Spotify, LinkedIn, Facebook, Threads, X, and the Russian torrent tracker RuTracker. Risky Plugins disclosed the campaign on September 19, 2026, after analyzing code and remote configuration between September 3 and 4. The cluster remained active on the last scan on September 18.
The extensions share a common codebase and were published through three linked Google accounts: sherechevskiy@gmail.com, andreysherechevskiy@gmail.com, and katia.noomova@gmail.com. The largest sample, a RuTracker VPN extension, accounts for roughly 200,000 of the group's estimated 356,000 installs. The extensions redirect web sessions through remotely controlled proxy infrastructure, exposing users to traffic interception.
What to watch: Chrome Web Store removals, any Google account suspension actions, and whether Risky Plugins publishes additional IOCs linking the extensions to a specific proxy service operator.
Timeline
-
original reporting
Fake Chrome VPN Extensions Hijack Browser Traffic Through Russian Proxy Network
cyberpress.org · 15d ago · September 29th, 2026
A Russian-language proxy network operating through dozens of Chrome extensions has exposed an estimated 356,000 users to browser-traffic interception. The campaign involves 31 linked extensions marketed as free “VPN for X” tools that can reroute web sessions through remotely controlled proxy infrastructure . Risky Plugins disclosed the activity on September 19, 2026, after analyzing the extensions’ code and remote configuration between September 3 and 4. The extension cluster remained active when researchers last scanned it on September 18. Fake Chrome VPN Extensions Hijack Browser Traffic The extensions were published through three reportedly linked Google accounts: sherechevskiy@gmail.com , andreysherechevskiy@gmail.com , and katia.noomova@gmail.com . Although promoted under different names, the tools share a common codebase and use a similar lure: promising access to a single blocked service. The catalog includes extensions presented as VPN services for YouTube, Telegram, Instagram, ChatGPT, Claude, Gemini, DeepSeek, Netflix, Discord, Spotify, LinkedIn, Facebook, Threads, X, and the Russian torrent tracker RuTracker. The largest sample, “РуТрекер VPN расширение для доступа к сайту,” accounts for roughly 200,000 of the group’s estimated 356,000 installs. Its Chrome extension ID is llngkcnndicadfcbikbjnhbcikpmaknj . Risky Plugins also identified non-VPN extensions within the same cluster, including a Telegram photo downloader, a Twitter/X post translator, a job-application h
-
update from gbhackers.com
Malicious VPN Extensions Turn Browser Users Into Residential Proxy Servers
gbhackers.com · 15d ago · September 29th, 2026
This ongoing campaign, revealed on September 19, 2026, has affected about 356,000 users, effectively turning their installed browsers into nodes in a residential proxy network. Researchers […] The post Malicious VPN Extensions Turn Browser Users Into Residential Proxy Servers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .