--- title: Hundreds of fake Chrome VPN extensions route traffic... description: Security researchers at Socket found over 737 Chrome Web Store extensions impersonating well-known VPN and proxy brands like Proton VPN, NordVPN, Surfshark,... canonical: https://daily.dev/posts/hundreds-of-fake-chrome-vpn-extensions-route-traffic-through-a-proxy-zzlu6yr8q twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hundreds of fake Chrome VPN extensions route traffic through a proxy | daily.dev og:description: Security researchers at Socket found over 737 Chrome Web Store extensions impersonating well-known VPN and proxy brands like Proton VPN, NordVPN, Surfshark,... og:url: https://daily.dev/posts/hundreds-of-fake-chrome-vpn-extensions-route-traffic-through-a-proxy-zzlu6yr8q og:image: https://api.daily.dev/og/posts/ZzLu6Yr8q.png og:image:alt: Hundreds of fake Chrome VPN extensions route traffic through a proxy og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hundreds of fake Chrome VPN extensions route traffic through a proxy **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary Security researchers at Socket found over 737 Chrome Web Store extensions impersonating well-known VPN and proxy brands like Proton VPN, NordVPN, Surfshark, ExpressVPN, and Cloudflare's 1.1.1.1, while secretly routing all browser traffic through SOCKS5 proxies run by a single operator. The extensions, downloaded nearly 75,000 times mostly by Russian users trying to bypass censorship, exposed destination sites, TLS SNI values, source IPs, and plaintext request bodies to the proxy operator. Indicators of intentional deception included fake premium server locations, nonfunctional payment mechanisms, misleading store disclosures, and post-approval remote configuration changes. Google has removed over 200 of the extensions, but more than 500 reportedly remain live on the Chrome Web Store. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How many fake VPN extensions were found on the Chrome Web Store routing traffic through a hidden proxy? More than 737 Chrome extensions impersonating VPN and proxy brands such as Proton VPN, NordVPN, Surfshark, ExpressVPN, and Cloudflare's 1.1.1.1 were found routing traffic through SOCKS5 proxies on port 1082, operated by a single provider using 40 publisher accounts. They were downloaded nearly 75,000 times, mostly by Russian users trying to bypass blocked services. _Follow security research like this on daily.dev to spot risky browser extensions before installing them._ ### What data can an attacker see if a malicious browser extension forces all traffic through their own SOCKS5 proxy? An attacker controlling the proxy can see every destination site, the TLS SNI value of each connection, the victim's source IP address, and any request body sent over plain HTTP. Researchers at Socket identified this exposure in a campaign of fake Chrome VPN extensions that funneled all browser traffic through proxies they controlled. _Developers building browser extensions can track proxy and privacy risks like this via daily.dev._ ### How can I tell if a Chrome VPN extension is fake or malicious? Warning signs include impersonating well-known VPN brands, advertising nonexistent premium server locations in countries like Japan or Singapore, nonfunctional payment or connection mechanisms, misleading disclosures submitted to store reviewers, and adding remote configuration changes only after the extension gets approved. Socket published extension IDs tied to one such campaign so users can check and remove them. _Stay ahead of extension-based threats affecting Chrome users by following security coverage on daily.dev._ ## Similar posts on daily.dev - [Two Chrome Extensions Caught Secretly Stealing Credentials from Over 170 Sites](https://daily.dev/posts/two-chrome-extensions-caught-secretly-stealing-credentials-from-over-170-sites-pps6thkfj) · The Hacker News · 67 upvotes · 1 comments - [Spying Chrome Extensions: 287 Extensions spying on 37M users](https://daily.dev/posts/spying-chrome-extensions-287-extensions-spying-on-37m-users-zc89tp8r9) · Hacker News · 0 upvotes · 0 comments - [260K\+ Chrome Users Duped by Fake AI Browser Extensions](https://daily.dev/posts/260k-chrome-users-duped-by-fake-ai-browser-extensions-ftkuwa8pg) · Dark Reading · 0 upvotes · 0 comments - [Over 100 Chrome extensions in Web Store target users accounts and data](https://daily.dev/posts/over-100-chrome-extensions-in-web-store-target-users-accounts-and-data-qecpawyca) · BleepingComputer · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#devtools](https://daily.dev/tags/devtools), [#malware](https://daily.dev/tags/malware), [#google-chrome](https://daily.dev/tags/google-chrome), [#vpn](https://daily.dev/tags/vpn) [View this post on daily.dev](https://daily.dev/posts/hundreds-of-fake-chrome-vpn-extensions-route-traffic-through-a-proxy-zzlu6yr8q) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hundreds of fake Chrome VPN extensions route traffic through a proxy","url":"https://daily.dev/posts/hundreds-of-fake-chrome-vpn-extensions-route-traffic-through-a-proxy-zzlu6yr8q","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hundreds-of-fake-chrome-vpn-extensions-route-traffic-through-a-proxy-zzlu6yr8q"},"datePublished":"2026-08-12T18:56:17.496Z","dateModified":"2026-08-12T18:57:13.770Z","description":"Security researchers at Socket found over 737 Chrome Web Store extensions impersonating well-known VPN and proxy brands like Proton VPN, NordVPN, Surfshark,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/74bfd86824b5d98ee15d17ba68c3ae5e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/74bfd86824b5d98ee15d17ba68c3ae5e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hundreds-of-fake-chrome-vpn-extensions-route-traffic-through-a-proxy-zzlu6yr8q","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,devtools,malware,google-chrome,vpn","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Hundreds of fake Chrome VPN extensions route traffic through a proxy"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hundreds-of-fake-chrome-vpn-extensions-route-traffic-through-a-proxy-zzlu6yr8q#faq","mainEntity":[{"@type":"Question","name":"How many fake VPN extensions were found on the Chrome Web Store routing traffic through a hidden proxy?","acceptedAnswer":{"@type":"Answer","text":"More than 737 Chrome extensions impersonating VPN and proxy brands such as Proton VPN, NordVPN, Surfshark, ExpressVPN, and Cloudflare's 1.1.1.1 were found routing traffic through SOCKS5 proxies on port 1082, operated by a single provider using 40 publisher accounts. They were downloaded nearly 75,000 times, mostly by Russian users trying to bypass blocked services. Follow security research like this on daily.dev to spot risky browser extensions before installing them."}},{"@type":"Question","name":"What data can an attacker see if a malicious browser extension forces all traffic through their own SOCKS5 proxy?","acceptedAnswer":{"@type":"Answer","text":"An attacker controlling the proxy can see every destination site, the TLS SNI value of each connection, the victim's source IP address, and any request body sent over plain HTTP. Researchers at Socket identified this exposure in a campaign of fake Chrome VPN extensions that funneled all browser traffic through proxies they controlled. Developers building browser extensions can track proxy and privacy risks like this via daily.dev."}},{"@type":"Question","name":"How can I tell if a Chrome VPN extension is fake or malicious?","acceptedAnswer":{"@type":"Answer","text":"Warning signs include impersonating well-known VPN brands, advertising nonexistent premium server locations in countries like Japan or Singapore, nonfunctional payment or connection mechanisms, misleading disclosures submitted to store reviewers, and adding remote configuration changes only after the extension gets approved. Socket published extension IDs tied to one such campaign so users can check and remove them. Stay ahead of extension-based threats affecting Chrome users by following security coverage on daily.dev."}}]} ```