A coordinated campaign of 737 malicious Chrome extensions impersonated trusted VPN brands like NordVPN, Proton, Surfshark, and ExpressVPN, routing users' browser traffic through attacker-controlled SOCKS5 proxies before researchers at Socket identified the operation.
The extensions accumulated over 75,000 combined installs across 40 developer accounts. Google removed 221 extensions, but more than 500 remained available as of mid-August 2026. The campaign targeted Russian-speaking users seeking access to blocked services, exploiting their need for privacy tools without delivering actual VPN protection.
737 fake Chrome VPN extensions impersonated established brands across 40 developer accounts with 75,000+ installs.
Traffic was redirected through attacker-controlled SOCKS5 proxies, not legitimate VPN infrastructure.
274 extensions impersonated security brands including NordVPN, Proton VPN, Surfshark, and ExpressVPN.
Google removed 221 extensions but left the publisher accounts active; over 500 fake VPNs remained available.
The campaign targeted Russian-speaking users seeking access to blocked services through free VPN extensions.
How the Fake VPN Extensions Worked
The 737 Chrome extensions posed as free VPN or proxy tools, mimicking the branding and interfaces of established providers. Instead of routing traffic through legitimate encrypted VPN tunnels, the extensions configured browser requests to pass through SOCKS5 proxies controlled by the attackers.
SOCKS5 proxies operate at a lower level than HTTP proxies, handling any traffic type without modification. This made them invisible to users expecting standard VPN behavior while giving attackers full visibility into unencrypted data passing through their servers.
Some extensions advertised premium server locations that did not exist. Users selecting "US server" or "German server" received nothing but proxy redirection to the attacker's infrastructure. The disconnect between advertised features and actual functionality went undetected because VPN connections appear active in browser toolbars regardless of where traffic actually routes.
Why Chrome Web Store Removal Was Incomplete
Google removed 221 extensions identified in the campaign, according to reporting from TechRadar. However, over 500 fake VPN extensions remained available on the Chrome Web Store after the takedown. The gap suggests the store's review process allows bad actors to publish replacement extensions faster than automated detection can catch them.
More critically, Google did not remove the underlying publisher accounts. The 40 developer accounts behind the campaign retained their ability to publish new extensions, meaning the operators can simply rebrand and relaunch under different names. Store-level removal without account suspension creates a whack-a-mole dynamic that benefits determined bad actors.
Socket published its initial findings on August 11, 2026. Multiple outlets including Bitdefender and The Hacker News corroborated the findings over the following days, confirming the scale and mechanism of the attack.
What Users Should Check Right Now
Anyone who installed a free VPN or proxy extension from the Chrome Web Store should audit their installed extensions immediately. Look for extensions matching these criteria:
– Extension names containing "VPN," "Proxy," "Surf," "Shield," "Guard," or similar privacy/security terms
– Logos or branding resembling known VPN providers (NordVPN, Proton, Surfshark, ExpressVPN)
– Extensions with vague descriptions or unusually generic developer information
– Extensions requesting broad permissions like "Read and change all your data on websites you visit"
Remove any suspicious extensions through chrome://extensions in your browser. Uninstall rather than just disable, which leaves the extension's code active in your browser profile.
For users who need VPN protection, download applications directly from the provider's official website or through verified app stores rather than browser extensions. Desktop and mobile apps from established providers undergo more rigorous verification and provide actual encrypted tunnels instead of proxy redirection.
How This Fits Into Broader Extension Security Risks
Browser extensions represent a significant attack surface because they run with elevated permissions inside the browser sandbox. A malicious extension can read cookies, intercept network requests, inject scripts, and modify page content — capabilities that persist until the user explicitly removes it.
Platform trust issues like Apple's proposed App Store commission policy show that store oversight matters. The Chrome Web Store's approval process relies heavily on automated scanning, which catches known malware patterns but struggles with novel impersonation campaigns. Extensions that mimic legitimate products often bypass automated checks because their code structure appears benign, even when their behavior is malicious.
This incident joins a pattern of supply-chain-style attacks through browser extensions. For context on how platforms respond to security flaws, see how Microsoft patched the actively exploited SharePoint vulnerabilities. Earlier campaigns have impersonated ad blockers, password managers, and productivity tools. The VPN angle is particularly dangerous because users installing VPN extensions are actively seeking privacy protection, making them less likely to question extensions that promise exactly what they want.
What This Means for VPN Users
Free VPN extensions carry inherent risk. The business model relies on monetizing user data, and malicious actors exploit that trust gap by offering the same product with worse intentions. Even legitimate free VPNs often log user activity or sell bandwidth to third parties.
The fake extension campaign demonstrates that brand impersonation is easy enough to execute at scale. Anyone searching for "free NordVPN" or "Proton VPN extension" in the Chrome Web Store could encounter a near-identical clone with thousands of installs and positive reviews fabricated by the same operator.
Users should treat any browser extension claiming to be a VPN with skepticism. When choosing tools, prefer official downloads like the official ChatGPT desktop app for Linux over browser-based alternatives. Verify the developer name against the provider's official documentation, check that the extension URL matches the company's verified domain, and prefer desktop applications over browser add-ons for anything involving traffic routing or encryption.
Conclusion
The 737 fake Chrome VPN extensions represent a coordinated campaign that exploited user demand for free privacy tools. By impersonating trusted brands and redirecting traffic through attacker-controlled proxies, the operators captured user data without providing any actual VPN protection. Google's partial takedown highlights the limitations of store-based moderation when publisher accounts remain active.
Users should audit their extensions, prefer official desktop applications for VPN needs, and verify developer information before installing any privacy tool. The Chrome Web Store remains a viable source for legitimate extensions, but vigilance is necessary when browsing tools that promise security benefits.
FAQ
Q: Can I tell if a VPN extension is fake by looking at its permissions?
A: Not reliably. Malicious extensions request the same broad permissions as legitimate ones. Check the developer name, installation date, and whether the publisher matches the brand's official documentation.
Q: Did Google block the fake extensions from appearing in search results?
A: No. The extensions remained searchable and installable even after the takedown. Google removed identified extensions but did not block related queries or prevent new copies from being published.
Q: Are my browsing credentials at risk if I used one of these extensions?
A: Yes, if the extension had access to your cookies, saved passwords, or unencrypted browsing data. Change passwords for any accounts you accessed while the extension was active, especially banking and email services.
Q: How many people were affected by this campaign?
A: Combined installs exceeded 75,000 across the 737 extensions. The actual number of unique users is lower because some accounts installed multiple extensions, but the total reach is significant.
Q: Should I switch to a paid VPN service?
A: Paid VPNs from reputable providers offer encrypted tunnels, no-logs policies, and accountable customer support. Free browser extensions cannot match that baseline, regardless of whether they are legitimate or malicious.
References
Socket Threat Research — 737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection
TechRadar — Hundreds of fake Chrome VPN extensions impersonating NordVPN, Proton, and more caught hijacking your traffic
The Hacker News — 737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One
Bitdefender — 737 fake Chrome VPN extensions route user traffic
Top comments (0)