737 Fake Chrome VPN Extensions Funnel Traffic Through One Proxy
Socket researchers traced 737 free Chrome VPN and proxy extensions — many impersonating brands like NordVPN and ExpressVPN — back to a single operator intercepting browser traffic through one SOCKS5 proxy.
Key Takeaways
- Socket found 737 free Chrome VPN/proxy extensions published across 40+ developer accounts, of which 274 impersonate 66 legitimate brands including NordVPN, ExpressVPN, ProtonVPN, and Cloudflare's 1.1.1.1.
- 520 of 522 analyzed extensions silently set `chrome.proxy.settings` to the same SOCKS5 server on port 1082 with a bypass list limited to loopback addresses — putting one operator in an adversary-in-the-middle position over all browser traffic.
- The campaign is linked to a Russian VPN reseller operating as Myxa VPN (Муха VPN) and primarily targets Russian-speaking users trying to reach blocked services such as Instagram, YouTube, and ChatGPT.
- 221 extensions have been pulled from the Chrome Web Store, but 516 remained active with roughly 58,000 combined installs at the time Socket published its research.
A free VPN browser extension is, by design, asking for the most sensitive permission a browser can grant: the ability to see and redirect every request the user makes. Researcher Kush Pandya at Socket has now shown what happens when hundreds of extensions asking for that permission turn out to be run by the same undisclosed operator.
One proxy, hundreds of storefronts
Socket identified 737 free VPN and proxy extensions published across at least 40 separate Chrome Web Store developer accounts, together accounting for 75,486 installs. Of those, 274 extensions impersonate 66 established VPN and privacy brands — including Proton VPN, NordVPN, Surfshark, ExpressVPN, CyberGhost, Windscribe, TunnelBear, Browsec, AdGuard VPN, Cloudflare's 1.1.1.1, and Google's Outline — reusing their names and branding to look like the real thing.
How the redirection actually works
The impersonation is the lure; the mechanism underneath is what matters. Socket found that 520 of 522 extensions it was able to retrieve and analyze set chrome.proxy.settings to a fixed SOCKS5 proxy server on port 1082, with a bypass list containing only loopback addresses — meaning effectively no traffic is excluded from the proxy. That configuration routes the user's entire browsing session through infrastructure controlled by a single party, regardless of which of the 66 impersonated brands the extension claims to be. A build artifact leaked in one of the packages — a Windows file path referencing a Russian-language documents folder — helped Socket link the operation to a Russian VPN subscription business trading as Myxa VPN (Муха VPN).
Why this isn't just a consumer VPN problem
The stated audience is Russian-speaking users seeking access to services blocked in their region, such as Instagram, YouTube, and ChatGPT — but the underlying risk generalizes. A browser extension with proxy permissions sits ahead of TLS termination on the client side: it can observe URLs, timing, and metadata for every site the user visits, including corporate SSO portals and SaaS admin panels, on any machine where an employee installed it outside of managed software controls. Unmanaged extension installs are a well-known BYOD and shadow-IT gap, and campaigns like this one show why 'it's just a VPN extension' is not a safe assumption for an enterprise endpoint.
What to check now
- Open
chrome://extensions, review every installed extension's permissions, and remove anything requesting proxy or 'read and change all your data on websites' access that you don't actively use. - Verify VPN extensions against the vendor's own website or official app store listing rather than trusting the Chrome Web Store name and logo alone.
- In managed environments, enforce an extension allowlist via Chrome enterprise policy (
ExtensionInstallBlocklist/ExtensionInstallAllowlist) rather than relying on users to vet permissions themselves. - Treat unexpected
chrome.proxyconfiguration changes, or DNS/network telemetry pointing at unfamiliar SOCKS5 endpoints, as an indicator worth investigating.
Socket reported the findings to Google; as of publication 221 of the 737 extensions had been removed from the Chrome Web Store, leaving 516 still live.
Frequently Asked Questions
How can I check if I have one of these extensions installed?
Open `chrome://extensions` in Chrome, review each extension's permissions, and check whether it requests proxy access. Cross-check the developer/publisher name against the official website of the VPN brand it claims to be — Socket found the malicious extensions were published from accounts unrelated to the real vendors.
Are the real NordVPN, ExpressVPN, or Proton VPN apps compromised?
No. This is brand impersonation, not a compromise of the legitimate vendors' own extensions or infrastructure — the malicious listings simply copy their names and branding on the Chrome Web Store.
Why do hundreds of differently-branded extensions all use the same proxy?
Socket's analysis found 520 of 522 examined extensions pointed to the same SOCKS5 server on port 1082, indicating the many storefront brands are a front for a single operator — linked to a Russian VPN business, Myxa VPN — funneling all users through one proxy network.