More than 737 browser extensions on the Chrome Web Store impersonated well-known VPN and proxy services while routing users’ traffic through SOCKS5 proxies operated by a single provider, researchers at application-security company Socket found.
How the extensions routed browser traffic through SOCKS5 relays
Socket identified a core technical pattern: 520 of the malicious extensions configured Chrome to route all browser traffic through the operator’s SOCKS5 proxies on port 1082. That configuration placed the operator’s server “to read every destination, every TLS SNI value, the victim’s source IP, and any request body sent over plain HTTP,” Socket explains. The researchers also observed that some extensions used techniques to hide the proxy destinations from analysis, including resolving proxy hostnames through Cloudflare or Google DNS-over-HTTPS.
Brands impersonated and subscription-fraud lures
The campaign impersonated dozens of established brands, including Proton VPN, NordVPN, Surfshark, ExpressVPN, and Cloudflare’s 1.1.1.1 DNS resolver. Many of the extensions advertised premium servers in locations that did not exist in the codebase: Japan, Singapore, Canada, Australia, and Turkey. Socket reports that these listings appear to be used for subscription fraud and that, based on strings found in the extensions, the campaign looks intended to funnel customers to a subscription-based VPN service in Russia.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleScale, distribution, and takedown status
The extensions were published under 40 different publisher accounts and shared a common analytics account. While available on the Chrome Web Store they were downloaded nearly 75,000 times, primarily by Russian users seeking tools to bypass blocked services. Socket collected and analyzed many of the items but noted that 212 extensions had already been removed by the time the researchers retrieved them. Google removed more than 200 of the extensions tied to the campaign after Socket’s findings, yet Socket reports that over 500 remain available in the store.
Indicators Socket identified as intentional deception
Socket lists several behavioral and content indicators that pointed to deliberate fraud rather than misconfiguration or sloppy engineering. These include:
- impersonation of well-known brands;
- advertising of nonexistent premium server locations;
- nonfunctional payment or connection mechanisms;
- misleading disclosures to store reviewers;
- adding remote configuration after the extension was approved;
- techniques to obscure proxy destinations from analysis.
Socket could not analyze all extensions’ code because some had been removed before collection, but the company has published the IDs of all extensions linked to the campaign and recommends users check their browsers against that list.
What this means for technologists, end users, and defenders
Technologists and security teams should treat browser extension proxy configuration as a possible post-compromise vector: Socket highlights the specific use of SOCKS5 on port 1082 and the use of remote configuration and DoH that can obscure malicious infrastructure. They should verify Chrome’s proxy configuration and cross-check installed extensions against the IDs published by Socket.
End users — especially those who installed extensions to bypass regional blocks — should inspect their browser extension list for impersonating names, remove any matching extensions, and confirm that Chrome’s proxy settings are back to normal, per Socket’s recommendation.
Defenders should note Socket’s broader caution: “Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.” The Blue Report 2026 is cited as measuring defenses technique by technique across 338 million simulations, a reminder in Socket’s account that post-access behavior matters as much as initial detection.
Socket’s findings paint a campaign that combines scale, impersonation, and operational techniques to keep proxy destinations hidden while funneling victims to paid services. With more than 500 of the identified extensions still available in the Chrome Web Store at the time of reporting, the risk remains active. Socket has published the extension IDs and urges users to remove any matches and verify proxy settings.
