{"id":2356,"date":"2026-08-12T15:04:20","date_gmt":"2026-08-12T15:04:20","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2356"},"modified":"2026-08-12T15:04:20","modified_gmt":"2026-08-12T15:04:20","slug":"737-chrome-vpn-extensions-caught-routing-traffic-through-proxies-check-if-you-have-one","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2356","title":{"rendered":"737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Aug 12, 2026<\/span><\/span>Browser Security \/ Privacy<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

A massive set of 737 free VPN and proxy extensions have been found to mainly target Russian-speaking users seeking access to blocked services with an aim to intercept browser traffic and route them through a proxy infrastructure.<\/p>\n

The extensions, published across at least 40 Chrome Web Store developer accounts, racked up 75,486 installs. Of those identified, 274 have been found to impersonate 66 established VPN and privacy brands, including Proton VPN, NordVPN, Surfshark, AdGuard VPN, Browsec, ExpressVPN, CyberGhost, Windscribe, TunnelBear, Cloudflare’s 1.1.1.1, and Google’s Outline, per Socket.<\/p>\n

The censorship circumvention extensions \u00abroute the user’s entire browser session through SOCKS5 proxies operated by a single provider,\u00bb security researcher Kush Pandya said<\/a>. \u00ab520 of the 522 in the bulk corpus route browser traffic through the same SOCKS5 infrastructure.\u00bb<\/p>\n

The vast majority of the extensions have been found to route users’ entire browser sessions by setting \u00abchrome.proxy.settings\u00bb to a fixed SOCKS5 server on port 1082, placing the threat actor in an adversary-in-the-middle (AitM) position to observe browser destinations, source IP addresses, TLS SNI values, and any request body sent over plain HTTP.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Every extension that configures a proxy also comes with a bypass list that only includes loopback addresses (i.e., the localhost or 127.0.0.1″), meaning every other browser request is funnelled through the SOCKS5 relay on port 1082 once the user connects to the purported VPN service.<\/p>\n

<\/p>\n

As many as 221 browser add-ons have been removed from the Chrome Web Store, while the remaining 516 extensions have been listed as active. The threat actor is said to be running a subscription VPN business in Russia, based on a 12-digit taxpayer number and the fact that some of them leak their Windows build path (\u00abC:\\Users\\ollob\\OneDrive\\\u0414\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b\\1.myxa-work\\08.06.26\\\\\\-release.zip\u00bb).<\/product><\/product><\/domain><\/p>\n

\"\"<\/a><\/div>\n

Ideally, the functionality is no different from a legitimate VPN or proxy service. The defining aspect of this activity is its attempt to impersonate established brands as opposed to offering it under their own name. Some of the other red flags include –<\/p>\n