737 Fake VPN Chrome Extensions Caught Hijacking Traffic via SOCKS5 Proxy
TL;DR: A cybersecurity investigation found 737 malicious Chrome extensions posing as VPN tools. 520 of them silently rerouted all browser traffic through an attacker-controlled SOCKS5 proxy — no split tunneling, no exceptions.
For developers and security folks, this one's worth a closer look.
The technical breakdown:
- Extensions used chrome.proxy.settings (a legitimate API) to hardcode a fixed SOCKS5 proxy
- The bypass list only excluded loopback addresses (127.0.0.1, localhost) — meaning literally everything else got proxied
- 104 extensions resolved proxy hostnames via DNS-over-HTTPS (Cloudflare/Google resolvers) to evade traditional DNS-based blocking
- Attackers gained full AitM position: TLS SNI visibility, real source IPs, and plaintext HTTP credentials
The scale:
- 75,486+ installs before detection
- 40+ developer accounts used across submissions
- 274 extensions impersonated 66 real VPN/privacy brands
- Identical (SHA-256 matched) falsified "no data sent" review documents reused across dozens of listings — suggesting a templated submission pipeline built to slip past Chrome Web Store review
There's also a PowerShell one-liner in the full writeup for auditing installed extensions with proxy permissions across a fleet — useful if you're doing endpoint triage or building detection tooling.
Full technical writeup, IOCs, and enterprise hardening checklist:
https://www.xpert4cyber.com/2026/08/737-fake-chrome-vpn-extensions-spying.html
What's your team's approach to auditing browser extension permissions at scale? Curious how others are handling this.
Top comments (0)