737 fake VPN extensions put one operator in the middle of 75,000 browser sessions

Socket has published research on 737 free VPN and proxy extensions in the Chrome Web Store that reconfigure the browser to route traffic through SOCKS5 proxies run by a single provider, with 75,486 installs between them across at least 40 developer accounts ^[1][2][3]. According to the researchers, 221 of the extensions have been removed and 516 remain listed as active ^[4], which means the adversary-in-the-middle position described in the report is still purchasable from the official store.

The mechanism is mundane and that is the point. The extensions set `chrome.proxy.settings` to a fixed SOCKS5 server on port 1082, and every extension that configures a proxy ships a bypass list containing only loopback addresses ^[5][6]. Once a user presses connect, everything except traffic to 127.0.0.1 goes through the relay. Socket's Kush Pandya says that places the operator in a position to observe browser destinations, source IP addresses, TLS SNI values, and any request body sent over plain HTTP ^[7]. Of the 522 extensions in the bulk corpus, 520 pointed at the same SOCKS5 infrastructure ^[8]. Socket could not analyse 212 of the 737 because they had already been pulled by the time the sample was collected ^[9].

The fleet was wide and shallow: an average of roughly 102 installs per extension ^[10]. That is the shape of an inventory built to survive individual takedowns rather than to win a single listing, and 40 publisher accounts sharing one analytics account is the seam that tied it together ^[3][11].

The deception is where Socket draws the line between this and a legitimate proxy service, whose plumbing would look the same ^[12]. 274 of the extensions impersonated 66 established VPN and privacy brands, including Proton VPN, NordVPN, Surfshark, ExpressVPN, AdGuard VPN, Browsec, CyberGhost, Windscribe, TunnelBear, Cloudflare's 1.1.1.1 and Google's Outline ^[13]. Premium server locations in Japan, Singapore, Canada, Australia and Turkey were advertised and did not exist ^[14]. Some extensions failed every connection attempt while presenting a complete fake interface, animation and status indicator included ^[15]. 104 resolved their proxy hostnames over Cloudflare or Google DNS-over-HTTPS to keep the operator's domain out of view ^[16]. Remote configuration was added after approval ^[17], and reviewers were handed identical justifications asserting "No data transmitted to external servers" and "No user tracking or logging" ^[18]. An internal manual titled, in translation, "Prompt for employees" told staff to supply only a resolved IP rather than a domain in the proxy settings, and not to reuse another extension's domain without instructions ^[19].

Socket attributes the activity to a subscription VPN business in Russia on the basis of a 12-digit taxpayer number and Windows build paths leaked in some packages ^[20]. Pandya is careful about the limit of the evidence: whether the operator owns the proxy servers or resells upstream capacity cannot be resolved from the extension code, and if it resells, another party sits in the same position ^[21]. What the packages establish, in Socket's words, is the impersonation, the undisclosed proxy configuration, the non-existent premium servers, the false statements to store reviewers, and the post-approval code substitution ^[22].

Watch the residual 516 listings, and the post-approval update channel generally. Netskope Threat Labs reports that a removed extension, "AI Sidebar with Deepseek, ChatGPT, Claude, and more," returned with a benign update that stripped its data theft code and acknowledged the wrongdoing, then two weeks later shipped a 21-line monetisation addition built around update and uninstall events through Google's CRX content delivery network on July 31, 2026 ^[23][24][25]. Store review is a point-in-time control; the code that runs on the endpoint is whatever arrived last. Socket has published the IDs of all extensions in the campaign, and users who find one should also confirm that Chrome's proxy configuration has been restored ^[26].