CERT24Fake Chrome VPN extensions route traffic through attackers' SOCKS5 proxiesLoading data…
CERT24Threat Observatory
Period

Fake Chrome VPN extensions route traffic through attackers' SOCKS5 proxies

More than 737 extensions published on the Chrome Web Store impersonated well-known VPN and proxy services while routing users' traffic through SOCKS5 proxies operated by a single provider. The extensions were downloaded nearly 75,000 times, mainly by Russian users. Google removed more than 200 related extensions, but the source reported that over 500 were still available in the Chrome Web Store.

← Back to intelligence

Fake Chrome VPN extensions route traffic through attackers' SOCKS5 proxies

More than 737 extensions published on the Chrome Web Store impersonated well-known VPN and proxy services while routing users' traffic through SOCKS5 proxies operated by a single provider. The extensions were downloaded nearly 75,000 times, mainly by Russian users. Google removed more than 200 related extensions, but the source reported that over 500 were still available in the Chrome Web Store.