Full Report
A massive set of 737 free VPN and proxy extensions have been found to mainly target Russian-speaking users seeking access to blocked services with an aim to intercept browser traffic and route them through a proxy infrastructure. The extensions, published across at least 40 Chrome Web Store developer accounts, racked up 75,486 installs. Of those identified, 274 have been found to impersonate 66
Analysis Summary
# Incident Report: Massive Impersonation Campaign via Chrome VPN Extensions
## Executive Summary
A large-scale campaign involving 737 malicious Chrome extensions was identified, primarily targeting Russian-speaking users. These extensions impersonated 66 legitimate VPN and privacy brands to intercept browser traffic by routing it through a controlled SOCKS5 proxy infrastructure. The operation, linked to a Russian-based entity, achieved over 75,000 installations before detection.
## Incident Details
- **Discovery Date:** August 12, 2026 (Public Reporting)
- **Incident Date:** Ongoing; key updates noted in June and July 2026
- **Affected Organization:** Users of Chrome Web Store; 66 impersonated brands (e.g., Proton VPN, NordVPN)
- **Sector:** Consumer Technology / Cyber Privacy
- **Geography:** Primarily Russia/CIS region
## Timeline of Events
### Initial Access
- **Date/Time:** Various (Campaign active through mid-2026)
- **Vector:** Software Supply Chain / Social Engineering
- **Details:** Attackers published 737 extensions across 40+ developer accounts on the Chrome Web Store, using the names and logos of trusted VPN providers to lure users.
### Lateral Movement
- **N/A:** This was a client-side browser attack; movement occurred by funneling all web traffic from the victim's browser to attacker-controlled servers.
### Data Exfiltration/Impact
- **Details:** Interception of entire browser sessions. Attackers gained an Adversary-in-the-Middle (AitM) position, allowing them to observe destination URLs, source IPs, TLS SNI values, and plain HTTP request bodies.
### Detection & Response
- **Discovery:** Identified by security researcher Kush Pandya and Socket researchers.
- **Response Actions:** 221 extensions were removed by Google; however, 516 remained active at the time of the report.
## Attack Methodology
- **Initial Access:** Impersonation of legitimate brands (Brandjacking) on the official Chrome Web Store.
- **Persistence:** Browser extension installation; once active, it remains until manual removal or store ban.
- **Defense Evasion:**
- Use of "bypass lists" (loopback only) to ensure all real traffic is proxied.
- Post-approval code substitution (adding remote-config layers after passing initial review).
- Submitting false "no data tracking" justifications to reviewers.
- Instructions to staff to use IP addresses instead of domains in settings to avoid detection.
- **Collection:** Routing all browser traffic through a fixed SOCKS5 server on port 1082.
- **Impact:** Traffic interception and potential data theft; secondary impact includes failed connections despite "fake" UI animations showing success.
## Impact Assessment
- **Financial:** Unknown; however, evidence suggests a subscription-based fraud model and "premium" tier scams.
- **Data Breach:** Exposure of browsing history, metadata, and unencrypted HTTP credentials/data for 75,486+ users.
- **Operational:** Disruption of privacy tools; users believed they were encrypted when they were actually being monitored.
- **Reputational:** Significant brand damage to the 66 impersonated companies.
## Indicators of Compromise
- **Network:** SOCKS5 traffic routed to port 1082 (various IPs).
- **File:** Chrome extension build path: `C:\Users\ollob\OneDrive\Документы\1.myxa-work\08.06.26\-release.zip`
- **Behavioral:**
- Extension requests `chrome.proxy.settings` permissions.
- UI shows "connected" status even when no data is flowing or backend fails.
- Presence of "Промт для сотрудников" (Employee Prompt) files in extension packages.
## Response Actions
- **Containment:** Google removed approximately 30% of the identified malicious extensions.
- **Eradication:** Researchers published the list of 40+ developer accounts to facilitate manual removal by users.
- **Recovery:** Users must manually audit and remove unrecognized or suspicious VPN extensions from Chrome.
## Lessons Learned
- **Store Trust Gap:** Official app stores can be bypassed using "clean" initial versions that are later updated with "poisoned" code.
- **Review Limitations:** Static analysis at the time of submission is insufficient to catch extensions that fetch remote configurations post-install.
- **User Vulnerability:** High-demand tools (like VPNs in censored regions) are primary targets for impersonation.
## Recommendations
- **Zero Trust Extensions:** Implement enterprise policies to block all browser extensions except those on an approved allowlist.
- **Verification:** Always verify the "Offered by" developer field in the Chrome Web Store against the official website of the service provider.
- **Network Monitoring:** Monitor for unusual SOCKS5 (port 1082) or proxy-related traffic originating from endpoint browsers.