Fake Chrome VPN Extensions Caught Hijacking Traffic in Massive Campaign

In an alarming disclosure that underscores the structural vulnerabilities of browser add-on ecosystems, cybersecurity researchers from the Socket Threat Research Team have uncovered a massive, coordinated malicious campaign involving 737 browser extensions on the Google Chrome Web Store. Positioned as tools to bypass digital censorship and guarantee online confidentiality, these add-ons were installed by more than 75,000 users worldwide. At the heart of this widespread operation was the strategic deployment of a fake Chrome VPN infrastructure designed not to encrypt or protect web traffic, but to silently intercept, inspect, and reroute browser activity through an adversary-controlled network relay.

Rather than establishing authentic end-to-end encrypted tunnels or masking origin IP addresses through legitimate virtual private network infrastructure, the malicious extensions hijacked internal browser settings. By programmatically modifying Chrome’s native proxy capabilities, the threat actor converted tens of thousands of client browsers into unwitting nodes within a centralized interception grid. This incident serves as a stark reminder that browser extensions, when granted high-level network permissions, possess the technical leverage to completely undermine the privacy guarantees that users seek when turning to privacy-enhancing technologies.

Campaign Architecture: Developer Syndicates and Fake Chrome VPN Brand Impersonation

The scale and sophistication of this campaign reveal a meticulously organized threat operation rather than an isolated set of rogue utilities. Socket’s analysis established that the 737 extensions were published across at least 40 separate Chrome Web Store developer accounts. Despite operating under disparate publisher profiles, the campaign exhibited clear technical centralization: multiple developer accounts shared common analytics tags, synchronized update schedules, and unified remote configuration endpoints. This decentralized front end allowed the threat actor to bypass marketplace monitoring, distribute risk across multiple developer personas, and maintain a persistent footprint even as individual listings were flagged and removed.

To drive adoption among users seeking censorship evasion—particularly Russian-speaking demographics attempting to access blocked news outlets and digital services—the threat actor heavily relied on brand impersonation. Out of the analyzed package repository, 274 extensions directly copied the branding, logos, and naming conventions of 66 premier privacy brands. The list of impersonated entities includes widely trusted services such as:

• Proton VPN
• NordVPN
• Surfshark
• ExpressVPN
• CyberGhost
• AdGuard VPN
• Cloudflare 1.1.1.1

By masquerading as legitimate, audited privacy vendors, the threat actor exploited established brand trust. Users who had already performed due diligence on commercial VPN providers were tricked into downloading fraudulent extensions under the assumption that they were installing official browser companions