737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection

Summary

A campaign involving 737 Chrome VPN and proxy extensions has been identified, with many impersonating established brands. These extensions secretly route all user browser traffic through SOCKS5 proxies controlled by a single provider, enabling traffic interception and potential subscription fraud. The campaign primarily targeted Russian-speaking users seeking access to blocked services, accumulating over 75,000 installs.

Full text

Back[Research][Security News]737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic RedirectionThe campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.Kush PandyaAug 11, 2026|21 min readSocket's Threat Research Team identified a campaign of 737 free VPN and proxy extensions published across at least 40 Chrome Web Store developer accounts, 274 of which impersonate 66 established VPN and privacy brands, that route the user's entire browser session through SOCKS5 proxies operated by a single provider. Socket analyzed the code of 525 of them, 522 from bulk retrieval and 3 more found during store enumeration; the remaining 212 had been removed from the store before collection and were recovered at listing level only. 520 of the 522 in the bulk corpus route browser traffic through the same SOCKS5 infrastructure.The campaign has accumulated 75,486 installs across 737 extensions, of which 516 were listed as active when the corpus was collected, carrying 58,318 installs. Install counts are the Chrome Web Store’s bucketed display values, so these are sums of buckets rather than exact headcounts.The campaign splits into three connected threat behaviors:Traffic interception: 520 of the 522 retrieved packages set chrome.proxy.settings to a fixed SOCKS5 server on port 1082 with a bypass list containing only loopback addresses, placing the threat actor in an adversary-in-the-middle position over all browser traffic.Detection evasion: 104 extensions declare host permissions for Cloudflare and Google DNS-over-HTTPS endpoints, resolve their own proxy hostnames through them, and hand Chrome a raw IP address, so the victim’s machine never emits a plaintext DNS query for the threat actor’s domains.Subscription fraud: The paid tier advertises servers in Japan, Singapore, Canada, Australia, and Turkey. Not one of those 200 hostnames resolved.Socket observed the client side only. The extensions place the threat actor in a position to read all browser traffic, and this report makes no claim about what the proxy servers retain or transmit. What is established from the packages and from public infrastructure is the impersonation, the undisclosed proxy configuration, the non-existent premium servers, the false statements submitted to store reviewers, and the post-approval code substitution.The populations behind the numbers in this post:737 extensions in the campaign, published from at least 40 developer accounts.734 of those appear in the source dataset. The other 3 were found later during store enumeration, published from 2 accounts outside the original 38.525 were retrieved with code and analyzed: 522 in bulk, plus those 3.522 is the denominator for every code-level figure in this post.520 of the 522 configure a proxy at all. The other 2 ship no proxy code.516 were live when the corpus was collected and 221 had been removed.212 were never retrieved and are known only at listing level.75,486 installs across all 737, of which 58,318 sit on the 516 live extensions.The same threat actor runs a subscription VPN business in Russia. Its published contract names an active, tax-registered self-employed provider, and its billing dashboard sells the browser extension as a paid tier. The extension estate is that business’ customer acquisition funnel.The extensions target Russian-speaking users seeking to reach services blocked inside Russia, including Instagram, ChatGPT, and YouTube. 690 of the 734 extensions in the source dataset are Russian-targeted by at least one of three tests: a Cyrillic listing name, a Cyrillic manifest description, or a blocked-service name in the listing. 520 of the 522 retrieved manifests carry Russian descriptions.Listings promise IP masking and traffic protection. One manifest in hfanmgjobgojpieocfemecgcgglmgpff reads:JSON{ "description": "Скрывает IP и защищает данные, подходит для любых устройств и сайтов. Рекомендовано Юрием Дудём." }That translates to “Hides IP and protects data, suitable for any devices and sites. Recommended by Yuriy Dud.” Yuriy Dud is a Russian journalist with no connection to this campaign, and the claim appears in an extension from an estate that impersonates 66 other real brands. Socket found no public record of any endorsement.66 real software brands are impersonated across 274 extensions and 38,140 installs, including Proton VPN, NordVPN, Surfshark, AdGuard VPN, Browsec, ExpressVPN, CyberGhost, Windscribe, TunnelBear, Cloudflare’s 1.1.1.1, and Google’s own Outline. Two impersonation targets are notable because they are the tools Russian users specifically trust to circumvent blocking: AmneziaVPN (22 extensions) and AntiZapret.The Proxy Hijack#The attack chain across the 522 retrieved packages: a lure listing requests the proxy permission alone, resolves its proxy host by one of three mutually exclusive methods, and forces every browser request through a SOCKS5 relay on port 1082, while a first-install redirect funnels the user toward the paid subscription tierEvery retrieved extension that configures a proxy at all, 520 of 522, performs the same operation. From aabaifmlfkdolhdbbhjblkeekaijfdfh/worker.js:JavaScriptconst config = { mode: "fixed_servers", rules: { singleProxy: { scheme: "socks5", host: node.host, port: node.port }, bypassList: BYPASS_LIST // = ["localhost", "127.0.0.1", "::1", "<-loopback>"] } }; chrome.proxy.settings.set({ value: config, scope: "regular" }, callback);BYPASS_LIST contains only loopback addresses. Every other destination, for every tab, is forced through the threat actor's SOCKS5 node once the user clicks Connect. There is no per-site scoping and no split tunneling.302 packages hardcode proxy IPs drawn from a single shared pool of 15 addresses, and 301 of those carry all 15.104 resolve a hostname over DNS-over-HTTPS and hand Chrome the resolved IP.SOCKS5 as configured here is a bare relay. It adds no encryption, sets no proxy credentials, and does nothing about WebRTC or operating-system DNS. 497 of the 522 request proxy and nothing else; the remainder add only storage, with one exception each for activeTab and notifications.Everything the extensions do not see, the proxy does. With all browser traffic forced through it, the threat actor’s server is positioned to read every destination, every TLS SNI value, the victim’s source IP, and any request body sent over plain HTTP. For a user in Russia, source IP plus timestamp is identity-adjacent, because an ISP can resolve it.The connected state renders the word “Защищено” (“Protected”) in 67 of 91 extensions in one code generation.Would a Legitimate Service Look Any Different?#At the mechanism level, no. A browser-scoped VPN has one API available to it, chrome.proxy, and a fixed-server SOCKS5 configuration with a loopback-only bypass list is the ordinary way to implement one. Any extension that proxies browser traffic necessarily places its operator in a position to observe that traffic. A provider building a genuine censorship-circumvention tool for Russian users would produce something that looks very much like the code above. The proxy hijack is the capability, not the finding.What separates this campaign from that hypothetical is everything around the proxy. A legitimate provider competes under its own name; 274 of these extensions impersonate 66 established brands, including AmneziaVPN and AntiZapret, the two tools this audience specifically trusts to get around blocking. A legitimate provider does not advertise server locations that do not exist; all 200 jp, sg, ca, au and tr subdomains across the 40 apex domains tested return no A record, and those are exactly the entries marked premium: true. A legitimate provider does not ship a paywall that cannot be satisfied, or an extension hardcoded to fail every connection behind a working connecting animation. A legitimate provider does not submit nine byte-identical justifications to store reviewers stating "No data trans

Indicators of Compromise

• domain — myxavpn[.]pro
• domain — app[.]myxavpn[.]pro
• domain — getmyxa[.]com
• domain — app[.]getmyxa[.]com
• domain — myxavpn[.]com
• domain — app[.]myxavpn[.]com
• domain — myxavpn[.]site
• domain — vpnmyxa[.]site
• domain — vpnmyha[.]shop
• domain — vpnkomar[.]space
• domain — myxavpn[.]space
• domain — skyproxy[.]space
• domain — maskirovka[.]space
• domain — sverchtun[.]store
• ip — 212[.]192[.]14[.]75
• ip — 158[.]160[.]228[.]178
• hash_sha256 — 1dea4975f7aaba71bf7821fcf62deca470ef5e21f45c947b103ddeb836ef9b81
• malware — Proxy Hijack

Entities