Reported by 3 outlets

Timeline

1. original reporting

   Fake VPN Extensions Put Operators in Adversary-in-the-Middle Position Over Chrome Traffic

   gbhackers.com · 62d ago · August 12th, 2026

   A Chrome Web Store operation that turns “free VPN” extensions into browser-wide traffic relays controlled by a single proxy provider. The campaign comprises 737 extensions published by at least 40 developer accounts, with 274 masquerading as 66 recognised VPN and privacy brands. The listings have accumulated 75,486 bucketed installs; 516 remained live at collection time, […] The post Fake VPN Extensions Put Operators in Adversary-in-the-Middle Position Over Chrome Traffic appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   Fake Proton VPN and NordVPN Chrome Extensions Route Users Through Unrelated Proxy Network

   cyberpress.org · 62d ago · August 12th, 2026

   A large network of fake Chrome VPN extensions impersonating trusted brands such as Proton VPN and NordVPN has been found routing users’ browser traffic through a separate SOCKS5 proxy network. Socket’s Threat Research Team identified 737 free VPN and proxy extensions linked to at least 40 Chrome Web Store developer accounts. Of these, 274 extensions impersonated 66 well-known VPN and privacy brands, including Proton VPN, NordVPN, Surfshark, ExpressVPN, Cloudflare 1.1.1.1, AmneziaVPN, and AntiZapret. The operation mainly targets Russian-speaking users trying to access blocked services such as Instagram, ChatGPT, and YouTube. Many listings used Cyrillic names and descriptions, while promising privacy, IP masking, and unrestricted access. Some also falsely claimed endorsements from public figures. Fake VPN Extensions Hijack Traffic Socket analyzed code from 525 extensions. Of the 522 packages collected in bulk, 520 configured Chrome to send browser traffic through the same SOCKS5 infrastructure on port 1082. The extensions use Chrome’s chrome.proxy.settings API with a fixed proxy configuration. Their bypass lists contain only loopback addresses such as localhost and 127.0.0.1. In practice, this means traffic from every browser tab is routed through the external proxy once a user clicks Connect. Socket’s AI scanner flagging the suspicious beha

3. update from bleepingcomputer.com

   Hundreds of fake Chrome VPN extensions route traffic through a proxy

   bleepingcomputer.com · 62d ago · August 12th, 2026

   Some of the extensions impersonated dozens of established brands, including Proton VPN, NordVPN, Surfshark, ExpressVPN, and Cloudflare’s 1.1.1.1 public domain name system (DNS) resolver. Researchers at application security company Socket found that the campaign relied on 40 publisher accounts and used a shared analytics account. While on the Chrome Web Store, the extensions were downloaded nearly 75,000 times, mainly by Russian users looking for tools to bypass blocked services in the country. “With all browser traffic forced through it [the relay], the threat actor’s server is positioned to read every destination, every TLS SNI value, the victim’s source IP, and any request body sent over plain HTTP,” Socket explains . 104 extensions resolved their proxy hostnames through Cloudflare or Google DNS-over-HTTPS to protect the operator’s domain from scrutiny. Extensions that advertised non-existent premium servers in Japan, Singapore, Canada, Australia, and Turkey for subscription fraud Socket could not analyze the code in all of the extensions because 212 of them had already been removed when th