Fake VPN Extensions Flood Chrome Web Store, Route Traffic Through Shared SOCKS5 Proxy

What happened

Researchers identified more than 737 browser extensions published on the Chrome Web Store that impersonated popular VPN and proxy services, according to a report from BleepingComputer. Rather than delivering the advertised privacy functionality, the extensions routed users' traffic through SOCKS5 proxies operated by a single provider.

Why it matters for defenders

Users installing these extensions believed they were getting a legitimate VPN/proxy tool, but instead had their browser traffic silently relayed through infrastructure controlled by an unknown third party. That creates exposure for any organization whose users install browser extensions from the Web Store without vetting — corporate credentials, session cookies, and browsing activity could all transit an untrusted proxy. At this scale (700+ extensions), this looks like a coordinated campaign rather than isolated abuse, and it highlights the Chrome Web Store as a persistent distribution vector for traffic-interception tooling.

What defenders should watch for

• Inventory browser extensions across managed endpoints, with particular attention to VPN/proxy-branded extensions not sourced from your organization's approved list.
• Review Chrome extension management policies (ExtensionInstallBlocklist/ExtensionInstallAllowlist) to restrict installs to vetted extension IDs.
• Hunt for outbound connections to SOCKS5 proxy endpoints from browser processes, especially patterns of many distinct client hosts connecting to a small set of proxy IPs.
• Watch for unusual DNS or TLS SNI patterns tied to extension update/check-in infrastructure rather than the VPN's advertised branding.
• Educate users that extension store listings and star ratings are not a reliable indicator of trustworthiness for VPN/proxy tools specifically, given how easily this category can be spoofed.

Developing story

This is based on a single vendor/press report and details such as full extension names, the identity of the proxy operator, and Google's remediation status may still emerge. Treat specifics as preliminary until confirmed. Source: BleepingComputer.