1 article on this topic.
Socket researchers traced 737 free Chrome VPN and proxy extensions — many impersonating brands like NordVPN and ExpressVPN — back to a single operator intercepting browser traffic through one SOCKS5 proxy.