737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One
Summary: Researchers found 737 free VPN and proxy extensions across at least 40 Chrome Web Store developer accounts, with 75,486 installs, mainly aimed at Russian-speaking users circumventing blocks. Of these, 274 impersonate 66 established brands including Proton VPN, NordVPN, and ExpressVPN, and 520 of 522 in the bulk corpus route browser traffic through the same SOCKS5 infrastructure on port 1082, with 221 removed from the store and 516 still listed as active.
Bottom line: Every request from an affected user passes through a server the threat actor controls, putting it in an adversary-in-the-middle position to observe destinations, source IPs, TLS SNI values, and plain-HTTP request bodies - and 516 of these extensions remain live in the Chrome Web Store.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026