737 Chrome VPN Extensions Redirect Traffic Through Proxies
Fake VPN extensions targeting Russian users to intercept browser traffic have been discovered.
1A Large-Scale Security Vulnerability
737 free VPN and proxy extensions are targeting Russian-speaking users to intercept browser traffic. These extensions were published across 40 different Chrome Web Store developer accounts and were installed 75,486 times. 274 of the extensions impersonate well-known brands like Proton VPN and NordVPN. Users' entire browsing sessions are redirected through a SOCKS5 proxy infrastructure controlled by threat actors.
2Brand Impersonation and Security Risks
According to researcher Kush Pandya, 520 of the extensions use the same SOCKS5 infrastructure. Sensitive data such as browsing destinations, source IP addresses, and TLS SNI values can be viewed by threat actors. The extensions redirect 'chrome.proxy.settings' to a fixed SOCKS5 server, putting users at risk of 'adversary-in-the-middle' (AitM) attacks.
3Bypass List and Redirection Mechanism
Every proxy-configured extension comes with a bypass list that only includes loopback addresses. This means that after users connect to the VPN service, all browser requests are routed through a SOCKS5 relay on port 1082. Users may not realize that all their data, except local network traffic, can be viewed by threat actors.
4Extensions Removed from Chrome Web Store
221 extensions were removed from the Chrome Web Store, but 516 remain active. Evidence suggests the threat actor operates a VPN business in Russia. Some extensions leaked Windows build paths ('C:\Users\ollob\OneDrive\Документы\1.myxa-work\08.06.26\domain\product\product-release.zip'), revealing their activities. Taxpayer numbers also confirm the threat actor's location.
5Premium Server Deception
The extensions promise premium servers, but these servers do not actually exist. Additionally, false statements were made during the store review process, and post-approval code changes were implemented. Pandya notes it's unclear whether the threat actor operates the proxy servers themselves or resells capacity from an upstream provider. In either case, user data is at risk.
6The Return of the AI Sidebar Extension
Netskope Threat Labs revealed that the 'AI Sidebar with Deepseek, ChatGPT, Claude, and more' Chrome extension returned months after being removed for Prompt Poaching tactics. The extension, which appeared to be cleaned between versions 1.7.2.0 and 1.7.3.0, released a malicious update via Google's CRX content delivery network on July 31, 2026.
7Update and Uninstall Trap
After releasing a benign update that removed data theft code, the extension returned with a new trap two weeks later. It no longer steals conversation data but opens an affiliate link every time the extension updates or uninstalls. It also blocks DeepSeek users from being redirected to ChatGPT. This reveals a new monetization scheme that risks user security.
8Growing Threats in Cybersecurity
While AI technologies help teams write code 10-50 times faster, security measures are falling behind. These developments remind users to carefully choose their extensions. When using VPN and proxy services, sticking to trusted brands and avoiding suspicious extensions is critical.
Original article: The Hacker News — 737 Chrome VPN Eklentisi Trafiği Proxy Üzerinden Yönlendiriyor