# Over 700 Fake VPN Apps Discovered on Chrome Web Store Malicious extensions designed to steal user data bypassed Google's security checks. - **Source:** [Lifehacker](https://brifing.si/source/f1400ced-a26b-4e58-a567-6187eca3708d) - **Published:** 2026-08-20 - **Original article:** - **On Brifing:** https://brifing.si/s/1563b301-44fd-4b5c-a81c-a3f60959f5c5 ## Scale of the Fake VPN Threat Socket's cybersecurity team analyzed 737 suspicious Chrome extensions claiming to offer VPN and SOCKS5 proxy services. Detailed code review of 525 extensions revealed 58,318 active installations. 274 extensions plagiarized branding from reputable providers like NordVPN and Surfshark. 104 extensions used DNS spoofing techniques to evade Chrome's blocklists, exposing users to severe privacy risks. ## How Users Are Being Deceived While many fake VPNs are free, some offer premium subscriptions promising private servers in countries like Japan and Singapore. Socket's DNS lookups proved these servers don't exist. One extension (Burņka VPN) doesn't route traffic at all, just displaying a fake interface. The lack of license verification mechanisms in paid tiers reveals systematic deception targeting unsuspecting users. ## Critical Security Vulnerabilities All analyzed extensions route traffic through fixed SOCKS5 proxies without split tunneling, meaning complete exposure of users' online activities. Two extensions specifically impersonated censorship-circumvention tools AmneziaVPN and AntiZapret. This gives attackers unrestricted access to sensitive user data, turning privacy tools into perfect surveillance instruments. ## Weaknesses in Moderation Processes Most fake VPNs were published by developer accounts previously banned after Palo Alto Networks' June 2025 report. With new developer accounts costing just $5 on Chrome Web Store, attackers quickly resumed operations. 40 accounts published over 700 extensions reaching tens of thousands of users. This exposes fundamental flaws in app store security reviews with global implications. ## Google's Warnings and Historical Context Google issued critical warnings in 2025 about similar fake VPN activities on Play Store. Socket's findings prove Chrome Web Store's moderation flaws persist. One extension's code even contained comments about evading detection: 'If rejected for auto-opening links, we'll use Telegram bot notifications instead.' This shows attackers' systematic approach to bypassing reviews. ## Target Audience and Geographic Focus Most fake VPNs target Russian users trying to bypass regional censorship, limiting international awareness of the threat. However, security experts warn the same methods could easily adapt to target users in US, EU and elsewhere. The Russia-focused attacks actually reveal a global platform security vulnerability affecting all Chrome users worldwide. ## Protection Measures for Users Experts recommend using only established, reputable VPN providers with verifiable track records. Free VPN offers should be treated with extreme skepticism, especially checking for proper license verification in premium services. Chrome Web Store ratings and download counts are unreliable indicators as they can be manipulated. Regular security scans remain crucial for protection. ## Impact on Industry and Regulations This scandal highlights persistent weaknesses in app store moderation systems. The $5 developer account fee clearly fails as a security barrier. Cybersecurity professionals demand stricter reviews for sensitive permissions like VPN access. The incident has reignited debates about necessary regulations in the digital security industry to prevent such widespread threats. ## Sources covering this story - https://lifehacker.com/tech/hundreds-of-fake-vpns-are-flooding-the-chrome-web-store?utm_medium=RSS — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._