737 Fake VPN Chrome Extensions Caught Hijacking Traffic via SOCKS5 Proxy

737 Fake VPN Chrome Extensions Caught Hijacking Traffic via SOCKS5 Proxy

TL;DR: A cybersecurity investigation found 737 malicious Chrome extensions posing as VPN tools. 520 of them silently rerouted all browser traffic through an attacker-controlled SOCKS5 proxy — no split tunneling, no exceptions.

For developers and security folks, this one's worth a closer look.

The technical breakdown:

• Extensions used chrome.proxy.settings (a legitimate API) to hardcode a fixed SOCKS5 proxy
• The bypass list only excluded loopback addresses (127.0.0.1, localhost) — meaning literally everything else got proxied
• 104 extensions resolved proxy hostnames via DNS-over-HTTPS (Cloudflare/Google resolvers) to evade traditional DNS-based blocking
• Attackers gained full AitM position: TLS SNI visibility, real source IPs, and plaintext HTTP credentials

The scale:

• 75,486+ installs before detection
• 40+ developer accounts used across submissions
• 274 extensions impersonated 66 real VPN/privacy brands
• Identical (SHA-256 matched) falsified "no data sent" review documents reused across dozens of listings — suggesting a templated submission pipeline built to slip past Chrome Web Store review

There's also a PowerShell one-liner in the full writeup for auditing installed extensions with proxy permissions across a fleet — useful if you're doing endpoint triage or building detection tooling.

Full technical writeup, IOCs, and enterprise hardening checklist:
https://www.xpert4cyber.com/2026/08/737-fake-chrome-vpn-extensions-spying.html

What's your team's approach to auditing browser extension permissions at scale? Curious how others are handling this.