Security researchers at Socket have identified 737 Chrome Web Store extensions that impersonate well-known VPN and proxy services while secretly routing users’ traffic through SOCKS5 proxies operated by a single unknown provider. The extensions spoofed brands including NordVPN, Proton VPN, Surfshark, ExpressVPN, and Cloudflare’s 1.1.1.1 DNS resolver — some publisher accounts each impersonating dozens of different recognizable names. Published through 40 separate publisher accounts tied together by a shared analytics account, the campaign racked up approximately 75,000 downloads before researchers flagged it, mostly from users in Russia trying to bypass blocked services.
Socket says the extensions’ traffic-routing mechanism looks technically similar to a legitimate VPN service — the deception is in the identity, not the mechanism. The campaign appears designed to funnel users into a subscription-based VPN service registered in Russia. Google has removed more than 200 of the flagged extensions, but over 500 remained available on the Chrome Web Store at time of reporting. Socket has published the full list of extension IDs so users can check whether any are installed in their browser.
How to check if you’re affected
Affected versions include any Chrome installation with one of the 737 identified extensions installed. Open Chrome’s extension manager (chrome://extensions), review what’s installed, and cross-reference against the Socket campaign list (linked below). Remove any extension you did not deliberately install or that matches a name from the impersonated brands above. After removing suspect extensions, go to Chrome’s proxy settings and confirm no custom proxy is configured.