More than 700 free VPN and proxy extensions on the Chrome Web Store have been caught routing users’ entire browser sessions through a single proxy infrastructure, placing a threat actor in a position to monitor every destination, source IP address, and unencrypted request body. The campaign, which primarily targets Russian-speaking users seeking to bypass censorship, represents one of the largest coordinated extension impersonation operations uncovered to date, with 274 of the 737 extensions masquerading as 66 established privacy brands including Proton VPN, NordVPN, Surfshark, AdGuard VPN, Browsec, ExpressVPN, CyberGhost, Windscribe, TunnelBear, Cloudflare’s 1.1.1.1, and Google’s Outline.
How 737 Chrome Extensions Delivered a Hidden Proxy Network
Security researcher Kush Pandya identified the sprawling network of extensions, which were published across at least 40 distinct Chrome Web Store developer accounts and collectively amassed 75,486 installations. The vast majority of these extensions share a single, critical technical flaw: they route the user’s entire browser session through SOCKS5 proxies operated by a single provider. Specifically, 520 of the 522 extensions in the bulk corpus examined direct traffic to the same SOCKS5 infrastructure, binding browser traffic to a fixed server on port 1082.
This configuration is achieved by setting Chrome’s chrome.proxy.settingscodecodecodecodecode API to a hardcoded SOCKS5 proxy address. Once a user connects to the purported VPN service, every browser request — with the sole exception of traffic to loopback addresses (127.0.0.1 and localhost) — is funnelled through the relay. This places the threat actor in an adversary-in-the-middle (AitM) position, capable of observing browser destinations, source IP addresses, TLS Server Name Indication (SNI) values, and any request body sent over plain HTTP.
Of the 737 extensions identified, 221 have been removed from the Chrome Web Store as of the latest reporting. The remaining 516 remain listed as active, continuing to pose a risk to users who have installed them. The bypass list included with every proxy-configuring extension contains only loopback addresses, meaning no external website or service is exempt from the proxy routing.
Who Is Behind the Proxy Extension Network?
The threat actor behind this operation is believed to be running a subscription VPN business based in Russia. Evidence supporting this conclusion includes a 12-digit taxpayer number associated with the operation and the discovery that some of the extension packages leak internal Windows build paths. One such path revealed the developer’s working directory: C:\Users\ollob\OneDrive\Документы\1.myxa-work\08.06.26\<domain>\<product>\<product>-release.zipcodecodecodecodecode. The folder structure indicates a build process dated June 8, 2026, and the use of a Russian-language document directory.
The extensions are designed to appeal specifically to Russian-speaking users who need access to blocked services. By impersonating well-known VPN brands, the operators offer a familiar and trusted solution to users seeking to circumvent censorship — while simultaneously intercepting their traffic. The brand impersonation is the defining characteristic of this campaign, distinguishing it from the typical operation of a legitimate VPN or proxy service that would offer its functionality under its own name.
What Are the Red Flags and Technical Indicators?
Beyond the central fact of traffic interception, the extensions exhibit several additional red flags that signal malicious intent. Understanding these indicators is critical for users, security teams, and browser extension reviewers:
- Fake premium tiers: Many extensions advertise paid subscription tiers or premium server locations that do not actually exist. Users who pay for these upgrades receive nothing of value, while the threat actor collects the payment.
- DNS-over-HTTPS blocklist evasion: The extensions attempt to bypass DNS-level blocking by using DNS-over-HTTPS, a technique that can circumvent corporate or ISP-level filtering but also masks the user’s DNS queries from legitimate security monitoring.
- Fake connection interfaces: Every connection attempt fails, yet the extension displays a complete, fake interface that includes a working connecting animation and a status indicator that appears to function normally. This creates the illusion of a working VPN service while the user’s traffic is actually being routed through the threat actor’s proxy.
- Internal employee manual: The extension packages include a file named “Промт для сотрудников” (translated to “Prompt for employees”). This document instructs developers to avoid putting the domain directly into
chrome.proxy.settingscodecodecodecodecode and instead provide only the resolved IP address. It also warns against using a domain from another extension without separate instructions, suggesting a deliberate attempt to evade detection by Chrome Web Store reviewers. - Policy evasion comments: Source code comments indicate a deliberate attempt to evade Chrome Web Store policies, including strategies to bypass review processes and hide the true nature of the extensions.
- Post-approval configuration changes: The extensions add a new remote-configuration layer after receiving approval from the Chrome Web Store, allowing the threat actor to update proxy settings or other malicious functionality without triggering a re-review.
- Gaming the review process: Multiple extensions submitted identical justifications to Chrome Web Store reviewers, using boilerplate statements such as “No data transmitted to external servers” or “No user tracking or logging” to appear benign.
These indicators collectively paint a picture of a sophisticated, organized operation that has invested significant effort in evading detection while maintaining a facade of legitimacy.
What Is the Risk to Users Who Have Installed These Extensions?
For every affected user, while the extension is connected, every request passes through a server the threat actor controls. This means that the threat actor can observe all browsing destinations, including the full URLs of websites visited, source IP addresses, TLS SNI values (which reveal the domain name of every HTTPS site visited), and any data sent over plain HTTP connections, including login credentials, session tokens, and personal information.
Whether the threat actor owns those proxy servers or resells capacity from an upstream provider is not resolvable from the extension code alone. If the actor is reselling capacity, then a further third party is also in a position to observe user traffic. The impersonation, undisclosed proxy configuration, non-existent premium servers, false statements submitted to store reviewers, and post-approval code substitution are all established facts from the packages and public infrastructure.
What Is the “AI Sidebar” Extension and How Does It Relate?
In a separate but related development, Netskope Threat Labs highlighted the return of a Google Chrome extension named “AI Sidebar with Deepseek, ChatGPT, Claude, and more.” This extension had been removed from the Chrome Web Store earlier in 2026 for engaging in Prompt Poaching tactics — a technique where the extension steals user prompts and conversations from AI services. Months after its removal, the extension resurfaced with a new monetization scheme.
The clean-then-poisoned update sequence, spread across versions 1.7.2.0 and 1.7.3.0, took place via Google’s CRX content delivery network on July 31, 2026. The update pushed out a monetization payload built around extension update and uninstall events. The extension released a benign update that removed the original data theft code and acknowledged its wrongdoing. However, after two weeks, it pulled the rug again with a new update that no longer contained the conversation-exfiltration code but instead contained a monetization payload that opens an affiliate link in a foreground browser tab every time the extension updates or uninstalls.
This case illustrates a pattern of behavior among malicious Chrome extensions: initial compromise, removal, rebranding, and re-emergence with a modified threat model. The “AI Sidebar” extension now suppresses the redirection of DeepSeek users to ChatGPT, suggesting an ongoing effort to manipulate user traffic for financial gain.
How Can Users Check If Their Chrome Extensions Are Affected?
Users concerned about their privacy and security should take the following steps to check whether any of the 737 malicious extensions are installed in their browser:
- Open Chrome’s extension management page by navigating to
chrome://extensionscodecodecodecodecode in the address bar. - Review the list of installed extensions carefully. Look for any VPN or proxy extensions that you did not intentionally install, or that appear to be impersonating a well-known brand.
- Check for suspicious names that closely resemble legitimate brands (e.g., “Proton VPN Free” instead of “Proton VPN”, “NordVPN Secure” instead of “NordVPN”).
- Examine the permissions each extension requests. Legitimate VPN extensions typically request permission to manage proxy settings, but they should also clearly explain why they need this permission. Any extension that requests access to all website data without a clear, legitimate reason should be treated with suspicion.
- Remove any extension that you do not trust or that appears on the list of known malicious extensions. After removal, clear your browser cache and cookies, and consider changing passwords for any accounts you accessed while the extension was active.
- Run a security scan using a reputable anti-malware tool that can detect Chrome extensions known to be malicious.
For organizations, IT and security teams should audit all Chrome extensions installed on managed devices, paying particular attention to proxy and VPN extensions. The 516 extensions that remain active in the Chrome Web Store continue to pose a risk, and users who installed them before the public disclosure may still be affected.
Why the Chrome Web Store Review Process Failed to Stop These Extensions
The success of this campaign highlights significant weaknesses in the Chrome Web Store’s review process. The threat actor deliberately gamed the system by submitting identical justifications across multiple extensions, all of which claimed that no data was transmitted to external servers and that no user tracking or logging occurred. These statements, while false, were sufficient to pass the initial review.
The post-approval configuration layer added by the extensions is particularly concerning. By adding a remote-configuration mechanism after receiving approval, the threat actor can change the extension’s behavior at any time without triggering a re-review. This technique, known as “post-approval code substitution,” is a well-known evasion tactic that has been used by malicious extensions for years. The Chrome Web Store has struggled to detect and prevent this practice, as it requires continuous monitoring of extension behavior rather than a one-time review.
The presence of an internal employee manual that explicitly instructs developers on how to evade detection further demonstrates the sophistication of the operation. The manual’s advice to use resolved IP addresses instead of domain names in proxy settings is a direct attempt to avoid keyword-based detection by store reviewers. The manual’s Russian language and the build path leaks both point to a development team that is geographically and linguistically distinct from the typical Chrome Web Store developer.
The Broader Implications for Browser Security and Privacy
This campaign represents a significant escalation in the threat landscape for browser extensions. The scale of the operation — 737 extensions across 40 developer accounts, impersonating 66 brands — suggests a well-resourced threat actor with a clear business model. The focus on Russian-speaking users seeking access to blocked services is particularly concerning, as it exploits the legitimate need for censorship circumvention to deliver a malicious proxy that intercepts traffic.
The monetization scheme is also noteworthy. By offering fake premium tiers and collecting payment for services that do not exist, the threat actor is generating revenue directly from victims while simultaneously capturing their browsing data. This dual-revenue model — payment fraud plus data interception — makes the operation financially sustainable and difficult to disrupt.
The return of the “AI Sidebar” extension with a modified monetization scheme underscores the persistence of malicious extension developers. Even after removal from the Chrome Web Store, these actors reapply with modified code that passes review, then update to restore malicious functionality after approval. This cat-and-mouse game between malicious developers and platform security teams is unlikely to end soon, and it places the burden of vigilance on users and organizations.
For users, the safest approach is to minimize the number of installed extensions, particularly those that handle sensitive data or modify network traffic. Legitimate VPN and proxy services should be installed only from official websites or verified sources, and even then, users should carefully review the permissions requested. For organizations, implementing a blocklist of known malicious extensions and using browser management tools to enforce extension policies can reduce the risk of exposure.
The 516 extensions that remain active in the Chrome Web Store represent an ongoing threat. Users who have installed any free VPN or proxy extension in recent months should check their browser immediately and remove any that appear suspicious. The threat actor’s infrastructure, including the SOCKS5 proxy servers and the subscription VPN business, remains operational, and the data collected from affected users may already be in the hands of the operator. The full extent of the data breach, and the ultimate destination of the intercepted traffic, may never be fully known.
