Chrome Web Store users warned of 737 fake VPN extensions

Security researcher Socket has identified a campaign involving 737 fraudulent VPN extensions on the Chrome Web Store. These extensions, spread across more than 40 developer accounts, include 274 that impersonate well-known privacy brands such as NordVPN, Proton VPN, Surfshark, ExpressVPN, CyberGhost, Windscribe, TunnelBear, and Cloudflare.

The campaign has reportedly accumulated 75,486 installations. While 221 extensions have already been removed by Google, 516 remain listed. Technically, these extensions function by redirecting browser traffic through a SOCKS5 proxy rather than providing a full device-wide VPN. The investigation revealed that the intermediate servers are controlled by an infrastructure linked to the Russian service Myxa VPN, meaning users believing they were using trusted brands were actually routing their traffic through an unrelated operator.