A Chrome Web Store operation that turns “free VPN” extensions into browser-wide traffic relays controlled by a single proxy provider.
The campaign comprises 737 extensions published by at least 40 developer accounts, with 274 masquerading as 66 recognised VPN and privacy brands.
The listings have accumulated 75,486 bucketed installs; 516 remained live at collection time, representing 58,318 installs.
The risk is the deception surrounding a browser proxy API that legitimate products may also use. Of 522 retrieved packages, 520 set chrome.proxy.settings to a fixed SOCKS5 endpoint on port 1082, bypassing only loopback addresses.
Once a victim presses Connect, every other browser destination is routed through operator-controlled infrastructure, without split tunnelling.
That arrangement puts the operator in an adversary-in-the-middle position. It can observe source IPs, destinations and TLS SNI metadata, while any traffic sent over plain HTTP including submitted credentials can be read in full.
Socket observed client-side code only and does not assert that the proxy infrastructure retained, altered or exfiltrated traffic.
The demonstrable issue is that users seeking privacy were unknowingly exposing sessions to an undisclosed intermediary.
The campaign is tailored largely to Russian-speaking users attempting to access blocked platforms such as Instagram, ChatGPT and YouTube.
Socket Researchers found that, 690 of 734 extensions in its source set used Cyrillic branding or descriptions, or referenced blocked services.
The operators also exploited trust directly: the impersonated brands include Proton VPN, NordVPN, Surfshark, ExpressVPN, Cloudflare’s 1.1.1.1, AmneziaVPN and AntiZapret.
A supposed endorsement from journalist Yuriy Dud appeared in one listing, despite no apparent connection to the operation.
Fake VPN Extensions
In 104 extensions, the code resolves proxy domains through Cloudflare or Google DNS-over-HTTPS, then supplies Chrome with a raw IP address.
This hides plaintext DNS lookups for operator domains and complicates detection. A further 66 packages use HTTP redirect handling and remote configuration to discover active infrastructure after installation, allowing the operators to move landing pages and configuration endpoints without issuing a store update.
The paid tier also appears deceptive. All 200 tested premium hostnames for Japan, Singapore, Canada, Australia and Turkey returned no A record, despite being advertised as paid locations.
In one code generation, any non-empty license string passed the premium check, yet the extension never wrote such a key to storage.
Socket also documented post-approval code substitution: 49 extensions received updated code adding remote configuration without a permission change, a tactic that weakens review-time assurance.
Infrastructure and embedded strings link the estate to the Myxa VPN, or “Муха VPN,” subscription business.
Socket found supplier references in 360 packages, shared analytics identifiers, clustered domain registrations and build paths referencing a myxa-work directory.
The evidence supports common operational control; it does not establish state sponsorship or identify an individual operator.
Google had removed 221 extensions, but 516 were still listed when the dataset was collected.
Palo Alto Networks previously reported a smaller cluster of fake VPN extensions that sent traffic through 15 hardcoded SOCKS5 servers, illustrating a broader marketplace abuse pattern.
Users should remove suspicious VPN add-ons, review Chrome’s proxy configuration, and rotate credentials entered on HTTP pages while an affected extension was active.
Organisations should hunt for extensions requesting proxy access, fixed SOCKS5:1082 configurations, DoH resolution calls and Myxa-linked infrastructure.
Its campaign scale, coordinated brand abuse and reviewer-evasion artefacts make this unusually consequential.
IOCs
| # | Indicator Type | Domain |
|---|---|---|
| 1 | Domain | atlasvpn[.]space |
| 2 | Domain | bezopasnet[.]space |
| 3 | Domain | cipherway[.]space |
| 4 | Domain | cloudmask[.]space |
| 5 | Domain | echosecure[.]space |
| 6 | Domain | gusentun[.]space |
| 7 | Domain | gusenvpn[.]online |
| 8 | Domain | horizonguard[.]space |
| 9 | Domain | internetprvpn[.]ru |
| 10 | Domain | ironproxy[.]space |
| 11 | Domain | korovkavpn[.]space |
| 12 | Domain | maskirovka[.]space |
| 13 | Domain | murvpn[.]space |
| 14 | Domain | myxasecure[.]space |
| 15 | Domain | myxavpn[.]space |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now
