A single threat actor uses multiple identities to run dozens of #AI-accelerated fake VPN Chrome e...

Summary

A single threat actor is running dozens of AI-accelerated fake VPN Chrome extensions. The malicious extensions route traffic through 15 SOCKS5 proxies, with some impersonating major VPN service providers, indicating a sophisticated and potentially widespread operation.

Indicators of Compromise

• malware — Fake VPN Chrome extensions

Entities