A large network of fake Chrome VPN extensions impersonating trusted brands such as Proton VPN and NordVPN has been found routing users’ browser traffic through a separate SOCKS5 proxy network.
Socket’s Threat Research Team identified 737 free VPN and proxy extensions linked to at least 40 Chrome Web Store developer accounts.
Of these, 274 extensions impersonated 66 well-known VPN and privacy brands, including Proton VPN, NordVPN, Surfshark, ExpressVPN, Cloudflare 1.1.1.1, AmneziaVPN, and AntiZapret.
The campaign had accumulated 75,486 displayed installs, while 516 extensions remained live with 58,318 installs at the time of collection.
The operation mainly targets Russian-speaking users trying to access blocked services such as Instagram, ChatGPT, and YouTube. Many listings used Cyrillic names and descriptions, while promising privacy, IP masking, and unrestricted access. Some also falsely claimed endorsements from public figures.
Fake VPN Extensions Hijack Traffic
Socket analyzed code from 525 extensions. Of the 522 packages collected in bulk, 520 configured Chrome to send browser traffic through the same SOCKS5 infrastructure on port 1082.
The extensions use Chrome’s chrome.proxy.settings API with a fixed proxy configuration.
Their bypass lists contain only loopback addresses such as localhost and 127.0.0.1. In practice, this means traffic from every browser tab is routed through the external proxy once a user clicks Connect.
This configuration puts the proxy operator in an adversary-in-the-middle position. The operator can potentially observe the websites a victim visits, TLS SNI metadata, the user’s source IP address, and any data sent over unencrypted HTTP.
Socket stressed that it only observed the client-side code and did not claim that the proxy servers retained or misused traffic. However, the extensions undeniably placed users’ browsing sessions under third-party proxy control.
The technical mechanism itself is not automatically malicious. Legitimate browser VPN tools also need proxy permissions to route browser traffic.
The major concern is the surrounding deception: brand impersonation, hidden infrastructure, fake premium offerings, and misleading store disclosures.
![The internal build manual the threat actor shipped inside a published extension, addressed to employees, with its project domain field filled in as skyproxy[.]space(Source: socke)](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj29TN3Q-kL0kz3fCTiFxPtDEAYDMhFui9OS4QYmoXyf_Y2tycdB10AQpKKdmGUMJ4AV0ReQtruevKUQ0GV1vdybx9H4gOz1g0GH-ZThgSh_xyRMb7C72k82gwR2in5tnJmMBxkHqjgGJTr9DfhMmAeKhke0dP2-W7um2mb08ytiuHsHJFIskQl2d1BzFqR/s640/2db42e6c7d3cdd8d94aa92ed930becc640a44978-1100x900.webp)
skyproxy[.]space(Source: socke)A total of 104 extensions used DNS-over-HTTPS services from Cloudflare or Google to resolve proxy hostnames. They then passed raw IP addresses to Chrome rather than domain names.
This avoids a normal plaintext DNS request from the victim’s device and makes domain-based blocking or investigation more difficult.
The campaign also used remote configuration. In 66 extensions, the code followed HTTP redirects to discover current infrastructure and download settings at runtime.
This allows operators to move domains without publishing a new extension update.
| Category | Details |
|---|---|
| Campaign size | 737 Chrome VPN/proxy extensions across at least 40 developer accounts |
| Brand impersonation | 274 extensions impersonated 66 brands, including Proton VPN, NordVPN, Surfshark, ExpressVPN, Cloudflare 1.1.1.1, AmneziaVPN, and AntiZapret |
The extensions promoted paid server locations in Japan, Singapore, Canada, Australia, and Turkey.
Socket tested 200 such premium subdomains across 40 domains and found that none returned an A record. In short, the advertised paid locations did not resolve.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
