Socket: 737 Malicious VPN/Proxy Chrome Extensions Impersonate 66 Brands

What it is

A campaign of 737 free VPN/proxy Chrome extensions (525 analyzed with code, 522 the code-level denominator) tied to a single Russian subscription-VPN operator that uses the extension estate as a customer-acquisition funnel. The actor is a tax-registered self-employed provider whose billing dashboard sells the extension as a paid tier. 274 extensions impersonate 66 real brands (Proton VPN, NordVPN, Surfshark, ExpressVPN, Cloudflare's 1.1.1.1, Google's Outline), including the two tools Russian users specifically trust to beat blocking: AmneziaVPN (22 extensions) and AntiZapret.

How it works

Every proxy-configuring extension (520 of 522) sets chrome.proxy.settings to a fixed SOCKS5 server on port 1082, with a bypassList of loopback addresses only — no per-site scoping, no split tunneling. This is a bare relay: no encryption, no proxy credentials, no WebRTC or OS-DNS handling, placing the actor adversary-in-the-middle over all browser traffic. Two provisioning styles exist:

• 302 packages hardcode proxy IPs from a single shared pool of 15 addresses (301 carry all 15).
• 104 resolve their proxy hostname over Cloudflare/Google DNS-over-HTTPS and hand Chrome a raw IP, so the victim never emits a plaintext DNS query for the actor's domains.

The paid tier advertises servers in Japan, Singapore, Canada, Australia, Turkey — none of those 200 hostnames resolved. Socket also cites false statements to store reviewers and post-approval code substitution.

Preconditions / Affected

Anyone who installed one of these extensions and clicked Connect — primarily Russian-speaking users (690 of 734 listings are Russian-targeted; 520 of 522 manifests carry Russian descriptions) trying to reach Instagram, ChatGPT, YouTube. 516 extensions were live at collection carrying 58,318 of the 75,486 total installs.

What to do

The most useful detection fingerprint the page gives: 497 of 522 extensions request only the proxy permission (the rest add just storage, with single exceptions for activeTab and notifications). A VPN extension whose sole permission is proxy, that sets a fixed SOCKS5 server on port 1082 with a loopback-only bypass list, is this pattern. Also look for host permissions declared for Cloudflare/Google DoH endpoints in a "VPN" extension, and hardcoded IPs from the 15-address pool. Watch for the impersonated-brand names above, and treat the "Recommended by Yuriy Dud" endorsement string as fraudulent — the journalist has no connection to the campaign.

Caveats

Socket observed the client side only and makes no claim about what the proxy servers retain or transmit — established facts are the impersonation, undisclosed proxy config, non-existent premium servers, false reviewer statements, and post-approval substitution. Install counts are Chrome Web Store bucketed display values summed across listings, not exact headcounts. 212 extensions were removed before collection and are known at listing level only.