Researchers found 737 Chrome Web Store extensions posing as VPN and proxy tools from brands including Proton VPN, NordVPN, Surfshark, ExpressVPN, and Cloudflare 1.1.1.1. Socket says the extensions, spread across 40 publisher accounts, forced browser traffic through SOCKS5 proxies on port 1082, used DNS-over-HTTPS via Google or Cloudflare to hide infrastructure, and were downloaded nearly 75,000 times before Google removed only part of the campaign.
Why it matters: People who installed these add-ons may have sent their browsing through an unknown operator that could observe destinations, IP addresses, and some unencrypted traffic. Users should remove any listed extensions immediately and verify Chrome’s proxy settings, while defenders should review browser-extension controls and monitor for unauthorized proxy changes.
Bill Toulas
2026.08.12
100% relevant
This article establishes a distinct campaign centered on hundreds of deceptive Chrome extensions that impersonate VPN brands and reroute user traffic through attacker-controlled proxy infrastructure.
← Back to all stories