A group of security researchers at Socket has uncovered a large-scale operation affecting the official Google Chrome extensions store. It involves 737 fake VPN extensions that, disguised as legitimate privacy tools, redirect all browser traffic to proxy servers controlled by the attackers. The campaign has amassed over 75.000 installations and impersonated popular brands, making this discovery a serious threat to user trust in the Chrome Web Store.
The most worrying aspect of this case is that these malicious extensions were published on the official Google Chrome store, a channel most people associate with a certain level of security. Researchers at Socket, who authored the technical report, confirmed that the primary objective was to force all traffic through a proxy , allowing the operators to read information about visited websites, the victim's IP address, and any requests sent via unencrypted HTTP. In other words, anyone who installs one of these extensions unknowingly hands over the keys to their browsing history to an unknown third party.
The magnitude of the fraud: impersonated brands and malicious behavior
The fake extension campaign has been meticulously designed to go unnoticed. Among the brands being impersonated are some of the most highly recommended VPNs in specialized media and used by millions of people: Proton VPN, NordVPN, Surfshark, ExpressVPN, AdGuard VPN, CyberGhost, Windscribe, TunnelBear, and Cloudflare's 1.1.1.1 service . The attackers know these applications are widely used, and that's why they mimic them to reach a larger number of potential victims. They have even gone so far as to impersonate Outline, a Google tool, and fabricate fake endorsements, such as one from a Russian journalist who supposedly recommended one of the extensions.
The technical analysis of the extensions reveals three clearly identified malicious behaviors. First, 520 extensions configured Chrome to route all browser traffic through the operator's SOCKS5 proxy servers on port 1082. Second, 104 extensions resolved their proxy hostnames through Cloudflare or Better DNS for Windows or Google DNS-over-HTTPS, a technique used to hide the operator's domain and prevent it from being easily blocked. And third, many of them advertised premium servers in Japan, Singapore, Canada, Australia, and Turkey that did not actually exist; the sole purpose was to obtain fraudulent subscriptions and payments for services that were never provided.
Researchers have also documented acquisition strategies that include impersonating well-known brands, promoting nonexistent premium server locations, and implementing non-functional payment or connection mechanisms. All of this comes at a negligible production cost: each Chrome Web Store developer account costs around $5, and the report estimates the cost per published extension at a mere 26 cents . This business model explains why attackers can afford to have their extensions removed by Google: they can always create new ones.
Who does this campaign affect?
Although the headline might be misleading, this campaign wasn't aimed at Spanish-speaking audiences or Europe. According to Socket's report, 94% of the campaign targeted Russian-speaking users , using the lure of access to services blocked in Russia, such as Instagram, ChatGPT, and YouTube. Of the 734 extensions in the original set, 690 are clearly identified as targeting this audience based on the language of their listing, the description in their manifest, or the name of a blocked service. Two of the brands that were imitated, AmneziaVPN and AntiZapret, are precisely the tools that Russian users employ to bypass censorship.
That doesn't mean the rest of the world is risk-free. In fact, the brands being impersonated are the same ones used in Spain and Latin America , and the method employed by the attackers—opening cheap accounts, mass-producing extensions, requesting seemingly harmless permissions, and modifying the code after the review—is not specific to any particular country. The store is the same, and any Chrome user anywhere in the world could have installed one of these extensions, lured by the trust inspired by seeing a familiar brand.
What to do to protect yourself from fake VPN extensions
The first thing you should know is that simply downloading extensions only from trusted sources, such as the Chrome Web Store itself, isn't enough. Google has removed approximately 221 of these malicious extensions , but at the time of this report, more than 500 remained active. Therefore, it's crucial to carefully review the behavior of any extension you install. You should pay attention to the developer's signature, the permissions it requests, and any updates it may have received that could have altered its functionality.
Additionally, it's best to limit the number of browser add-ons installed as much as possible. When installing a VPN extension, it's safest to go directly to the provider's website , such as NordVPN, Proton VPN, or Surfshark, and download the extension from there. This ensures you install legitimate software that hasn't been modified by a malicious third party. It's also a good idea to check your browser's proxy settings periodically to ensure there are no unusual redirects.
If you think you might have installed one of these extensions, uninstall it immediately, but don't stop there. Change any passwords you entered on sites without HTTPS while the extension was active, and assume that your browsing during that period could have been monitored by a third party. Regarding general computer protection, having a good antivirus and keeping your system updated remains crucial, although in this specific case, the antivirus wouldn't have detected anything because the threat arrived as a download approved by the store, not as an infected file.
Finally, this case highlights an uncomfortable truth: just because something is in the official Chrome Web Store is no guarantee of security . The campaign involving 737 fake extensions is the largest documented to date in the Google store, and although the company has taken action by removing many of them, the attackers' business model allows them to keep trying. The recommendation is clear: install only what's essential, be wary of free VPNs in your browser, and if you need one, always go to the official provider's website.
