Malicious Chrome Extensions Route Traffic Through Proxies

"For each affected user, while the extension is connected, every request passes through a server the threat actor controls," security researcher Kush Pandya said.

SOCKS5 routing, chrome.proxy.settings and an adversary-in-the-middle position

Pandya and the analysis he shared identify a single technical pattern repeated across hundreds of extensions: the add-ons set chrome.proxy.settings to a fixed SOCKS5 server on port 1082 and include a bypass list that contains only loopback addresses. That configuration funnels virtually every browser request through a SOCKS5 relay, placing the operator in an adversary-in-the-middle (AitM) position able to observe browser destinations, source IP addresses, TLS SNI values and any request body sent over plain HTTP.

Socket's analysis found that "520 of the 522 in the bulk corpus route browser traffic through the same SOCKS5 infrastructure," underscoring the reuse of the same proxy backend across the group. Pandya noted it is not possible from the extension code alone to determine whether the threat actor owns those proxy servers or resells capacity from an upstream provider; if resold, an additional party would be positioned to observe the same traffic.

Scale and impersonation: 737 extensions, 75,486 installs, 66 brands targeted

The set totals 737 free VPN and proxy extensions published across at least 40 Chrome Web Store developer accounts and recorded 75,486 installs. Of those identified, 274 were found impersonating 66 established VPN and privacy brands — the source lists Proton VPN, NordVPN, Surfshark, AdGuard VPN, Browsec, ExpressVPN, CyberGhost, Windscribe, TunnelBear, Cloudflare's 1.1.1.1, and Google's Outline among the impersonated names.

Chrome Web Store takedowns have removed as many as 221 of the add-ons; the remaining 516 extensions were listed as active at the time of reporting.

How the operators hid intent and gamed store review

Extensions advertised paid or premium tiers and "premium locations" that do not exist in the published code or configuration.
They employed DNS-over-HTTPS blocklist evasion and sometimes failed every connection attempt while presenting a fully functioning-looking interface (connecting animations and status indicators) to users.
Internal materials — including a manual named "Промт для сотрудников" ("Prompt for employees") — instructed developers to avoid placing domains directly into chrome.proxy.settings, to provide only resolved IPs, and to avoid using another extension's domain without separate directions.
Comments in the packages and repeated post-approval changes show a deliberate attempt to evade Chrome Web Store policies, including adding a new remote-configuration layer after extension approval and submitting identical review justifications stating "No data transmitted to external servers" or "No user tracking or logging."

Socket summarized the confirmed behaviors succinctly: "the impersonation, the undisclosed proxy configuration, the non-existent premium servers, the false statements submitted to store reviewers, and the post-approval code substitution."

Attribution clues: a Russia-linked subscription business and leaked build paths

Analysts tied the operation to a subscription VPN business in Russia on the basis of a 12-digit taxpayer number and leaked Windows build paths found in some packages. The path string appears in the reporting exactly as: C:\Users\ollob\OneDrive\Документы\1.myxa-work\08.06.26\, a breadcrumb the researchers used as part of the linkage that suggests an operator located in Russia.

Netskope Threat Labs: a removed extension returns with a monetization payload

Separately, Netskope Threat Labs reported that a previously removed Google Chrome extension named "AI Sidebar with Deepseek, ChatGPT, Claude, and more." resurfaced via Google's CRX delivery network on July 31, 2026. The update sequence across versions 1.7.2.0 and 1.7.3.0 replaced earlier prompt-poaching code with a compact monetization scheme: a "surgical" 21-line addition that opens an affiliate link in a foreground tab every time the extension updates or uninstalls and suppresses DeepSeek users' redirection to ChatGPT.

Netskope noted that the extension previously released a benign update acknowledging its wrongdoing, then two weeks later "pulled the rug again with a new update" that implemented the monetization payload.

What this means for technologists, Chrome Web Store reviewers, and end users

Technologists and security teams: watch for extensions that programmatically set chrome.proxy.settings to SOCKS5 endpoints (port 1082 in these cases) and include bypass lists restricted to loopback addresses; such changes indicate full-browser proxying rather than local or selective routing.
Chrome Web Store reviewers and platform teams: the campaign demonstrates how identical review justifications and post-approval remote-configuration layers can be used to pass scrutiny; reviewers may need to flag identical boilerplate submissions claiming "No data transmitted to external servers" when other indicators point to proxying behavior.
End users: hundreds of extensions were impersonating legitimate VPN brands and advertising non-existent premium tiers; when an extension funnels browser traffic through external SOCKS5 relays, the operator can observe destination metadata and, for unencrypted HTTP, request bodies.

The record assembled in the reporting is narrow but stark: hundreds of extensions, a single recurring proxy configuration, widespread impersonation, and techniques aimed at evading post-publication scrutiny. Whether the proxies are owned outright by the operator or resold from a third party remains unresolved from the package code, but either outcome places users' browser traffic in the hands of actors other than the brands the extensions claim to represent. The practical question left for platform operators and security teams is not whether abuse can happen — it has — but how persistently and at what scale it will be detected and removed.

https://thehackernews.com/2026/08/737-chrome-vpn-extensions-caught.html