Security researchers at Socket have identified a coordinated campaign involving 737 Chrome VPN and proxy extensions that impersonate legitimate VPN and privacy brands while redirecting browser traffic through shared SOCKS5 proxy infrastructure.
The campaign accumulated 75,486 installs and was distributed across at least 40 Chrome Web Store developer accounts. Of the 737 extensions, 274 impersonated 66 established VPN and privacy brands.
Key Highlights
- 737 Chrome VPN and proxy extensions identified.
- 75,486 total reported installs.
- At least 40 developer accounts involved.
- 274 extensions impersonated 66 legitimate brands.
- 525 extensions were retrieved and analyzed by Socket.
- 520 of 522 analyzed proxy-capable extensions routed traffic through the same SOCKS5 infrastructure.
- SOCKS5 proxy traffic was configured on port 1082.
- 104 extensions used DNS-over-HTTPS to resolve proxy infrastructure.
- 221 extensions had been removed from the Chrome Web Store when the research corpus was collected.
- 516 extensions remained listed as active.
- Premium VPN server locations advertised by the extensions did not resolve during testing.
Brand Impersonation
The campaign targeted Russian-speaking users looking for VPN services capable of accessing blocked websites and applications.
Socket identified 66 legitimate brands being impersonated across 274 extensions.
Impersonated brands included:
- Proton VPN
- NordVPN
- Surfshark
- AdGuard VPN
- Browsec
- ExpressVPN
- CyberGhost
- Windscribe
- TunnelBear
- Cloudflare 1.1.1.1
- Google Outline
- AmneziaVPN
- AntiZapret
The extensions used names, descriptions and branding designed to make them appear associated with legitimate VPN providers.
Browser Traffic Redirection
The central behavior of the campaign is the modification of Chrome's proxy configuration.
The extensions use:
chrome.proxy.settings
to configure a fixed SOCKS5 proxy.
The configuration uses:
- SOCKS5 protocol
- Port
1082 - A small loopback-only bypass list
As a result, browser requests outside localhost addresses can be routed through the configured proxy.
There is no per-site scoping or split tunneling in the observed configuration.
This can place the proxy operator in an adversary-in-the-middle position for browser traffic.
Potentially Exposed Information
The research establishes that browser traffic is routed through the proxy infrastructure, but does not establish exactly what the operators store or retain.
Depending on the destination and protocol, a proxy operator may potentially observe:
- Source IP address
- Destination hosts
- TLS SNI information
- HTTP traffic
- Browsing destinations
- Unencrypted credentials and content transmitted over HTTP
HTTPS protects the contents of properly encrypted connections, but routing traffic through an unknown third-party proxy still creates significant privacy and security concerns.
Shared Proxy Infrastructure
Socket analyzed 522 extensions containing proxy-related code.
Of these:
520 extensions configured the same SOCKS5 proxy behavior.
The research found that:
- 302 packages contained hardcoded proxy IP addresses.
- The IPs were drawn from a shared pool of 15 addresses.
- 301 of those packages contained all 15 addresses.
- 104 extensions resolved proxy hostnames through DNS-over-HTTPS.
The use of common infrastructure strongly links the extensions to the same campaign.
DNS-over-HTTPS Evasion
A subset of 104 extensions used DNS-over-HTTPS to resolve proxy hostnames.
The extensions interacted with DNS-over-HTTPS infrastructure operated by services such as Google and Cloudflare.
After resolving the proxy hostname, the resulting IP address was provided directly to Chrome.
This approach can prevent the victim's system from generating a conventional plaintext DNS query for the campaign's proxy domain.
Consequently, organizations relying exclusively on DNS-based blocking may have difficulty detecting the activity.
Fake Premium VPN Servers
The extensions also advertised premium VPN servers in locations including:
- Japan
- Singapore
- Canada
- Australia
- Turkey
Socket tested 200 premium hostnames across 40 domains.
None of the tested premium hostnames returned an A record.
This indicates that the advertised premium infrastructure was not operational as represented during the research.
Subscription and Monetization
The campaign was linked to a VPN subscription business operating under the Myxa VPN / Муха VPN branding.
Some extensions advertised premium access supplied by the same VPN provider.
Socket identified common infrastructure, analytics identifiers, build artifacts and other technical indicators linking the browser-extension estate to the VPN business.
The research describes the extension ecosystem as a customer-acquisition channel for the subscription service.
Chrome Web Store Evasion
The researchers found multiple indicators of deliberate attempts to bypass Chrome Web Store review.
These included:
- Comments discussing potential store rejection.
- False privacy statements.
- Claims that no data was transmitted externally.
- Post-approval code changes.
- Remote configuration functionality added after review.
- Multiple extensions containing identical reviewer-justification documents.
- Multiple publisher accounts distributing structurally similar code.
One analyzed extension included comments explicitly discussing replacing automatic external-link behavior if Chrome Web Store reviewers rejected it.
Post-Approval Code Changes
Socket identified 49 extensions across 18 publisher accounts that received code changes after approval.
The changes included the addition of remote-configuration functionality.
In one example, the reviewed version did not contain remote configuration functions, while the later version introduced functions capable of retrieving remote configuration and landing-page information.
The permission set remained unchanged.
This demonstrates why security review based only on extension permissions may not detect malicious functionality introduced after approval.
Coordinated Review Gaming
Researchers identified a file named:
PRIVACY_JUSTIFICATIONS.md
inside multiple extensions.
Nine copies of the document were byte-identical and shared the same SHA-256 hash:
1dea4975f7aaba71bf7821fcf62deca470ef5e21f45c947b103ddeb836ef9b81
The documents contained claims including:
- No personal data collected.
- No data transmitted externally.
- No user tracking.
- No remote code.
The code behavior observed by Socket contradicted these statements.
Campaign Attribution
Socket linked the extensions through multiple independent technical indicators.
These included:
- Shared proxy infrastructure.
- Common build artifacts.
- Shared analytics identifiers.
- Similar code-generation patterns.
- Common domains.
- Identical reviewer documentation.
- Shared VPN-provider references.
- Common naming conventions.
- Shared Windows build paths.
One build artifact exposed a Windows path containing:
C:\Users\ollob\OneDrive\Документы\1.myxa-work\
The infrastructure and software naming patterns consistently linked the extensions to the same operational ecosystem.
Impact
The campaign is particularly concerning because users installed the extensions specifically to protect or anonymize their browsing.
Instead, the extensions can redirect browser traffic through infrastructure controlled or selected by the campaign.
The research does not claim that the proxy operators actually logged or retained all traffic. However, the technical capability places the proxy operator in a position where sensitive browser metadata and unencrypted HTTP traffic could potentially be observed.
The campaign also creates risks for users accessing:
- Corporate applications
- Social media
- Financial websites
- Internal web portals
- Cloud services
- Authentication pages
Detection and Hunting Opportunities
Security teams should monitor for:
- Unauthorized Chrome extensions.
- Extensions requesting the
proxypermission. - Unexpected changes to
chrome.proxy.settings. - SOCKS5 connections to TCP/1082.
- Connections to known campaign IP addresses.
- DNS-over-HTTPS requests associated with proxy resolution.
- Browser traffic suddenly originating from unfamiliar IP addresses.
- Extensions impersonating established VPN brands.
- Browser extensions with remote configuration functionality.
- Unexpected external links opened after extension installation.
- Chrome extension updates that introduce new network functionality.
- Suspicious extension publisher accounts.
- Multiple extensions with highly similar code structures.
Recommended Mitigations
- Audit all Chrome extensions installed across the organization.
- Remove unauthorized VPN and proxy extensions.
- Maintain an enterprise allowlist for browser extensions.
- Monitor extensions requesting the
proxypermission. - Monitor modifications to Chrome proxy settings.
- Block known malicious proxy infrastructure.
- Monitor outbound SOCKS5 connections, especially TCP/1082.
- Monitor DNS-over-HTTPS activity where enterprise policy permits.
- Review browser extension updates for unexpected functionality changes.
- Use endpoint telemetry to detect suspicious Chrome extension behavior.
- Investigate accounts that installed impersonating VPN extensions.
- Rotate credentials entered through unencrypted HTTP while an affected extension was active.
- Invalidate sensitive browser sessions following suspected exposure.
Threat Assessment
This campaign demonstrates how malicious browser extensions can abuse the trust users place in VPN and privacy software.
The combination of brand impersonation, browser-wide proxy redirection, DNS-over-HTTPS infrastructure resolution and Chrome Web Store review evasion makes the campaign particularly difficult to detect using traditional reputation-based controls.
The campaign also highlights the importance of monitoring extension behavior rather than relying solely on publisher names, permissions or store availability.
Indicators of Compromise
IP::212[.]192[.]14[.]75 103[.]35[.]189[.]225103[.]35[.]191[.]173147[.]45[.]60[.]241147[.]45[.]60[.]252178[.]130[.]47[.]43178[.]130[.]47[.]44178[.]130[.]47[.]50178[.]130[.]47[.]129185[.]252[.]215[.]97185[.]252[.]215[.]98194[.]150[.]220[.]16345[.]89[.]110[.]2275[.]180[.]30[.]155[.]180[.]30[.]12280[.]92[.]204[.]3380[.]92[.]204[.]4780[.]92[.]206[.]8486[.]104[.]74[.]11094[.]131[.]118[.]3994[.]131[.]118[.]237138[.]124[.]244[.]206130[.]17[.]1[.]1978[.]153[.]155[.]11281[.]90[.]31[.]7395[.]163[.]244[.]138Domains::myxavpn[.]promyxasecure[.]spacesverchtun[.]storevpnmyxa[.]sitevpnmyha[.]shopvpnkomar[.]spacezhuknet[.]onlinezhukvpn[.]onlinemaskirovka[.]space
Conclusion
Organizations should treat browser VPN and proxy extensions as security-sensitive software.
A legitimate-looking VPN extension can potentially control how browser traffic leaves the endpoint. Security teams should therefore enforce extension allowlists, monitor proxy-setting changes and investigate unexpected SOCKS5 traffic.
Users should verify the publisher and official distribution channel before installing VPN extensions and should remove any extension associated with this campaign.
Note: For the 737 browser extension IDs, please navigate to the Threat Data section and locate the file “737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection.”
Please use the extension IDs listed in the file to add them to the security solutions monitoring/watchlist for tracking and detection.