Full Report
More than 737 browser extensions published on the Chrome Web Store impersonated well-known VPN and proxy services while routing users' traffic through SOCKS5 proxies operated by a single provider. [...]
Analysis Summary
# Tool/Technique: Malicious VPN/Proxy Extension Campaign
## Overview
This campaign involves a massive cluster of over 737 malicious Google Chrome extensions designed to impersonate legitimate VPN providers (e.g., NordVPN, Proton VPN). The primary purpose is to hijack user traffic by routing it through unauthorized SOCKS5 proxies, likely for data harvesting, traffic monitoring, or funneling users toward fraudulent Russian subscription services.
## Technical Details
- **Type:** Malware (Browser Extension / Proxy Hijacker)
- **Platform:** Google Chrome / Chromium-based browsers
- **Capabilities:** Traffic interception, DNS-over-HTTPS (DoH) resolution, subscription fraud, proxy configuration manipulation.
- **First Seen:** Identified/Reported August 2026.
## MITRE ATT&CK Mapping
- **[TA0006 - Credential Access]**
- **[T1557 - Adversary-in-the-Middle]**: Intercepting traffic via proxy.
- **[TA0005 - Defense Evasion]**
- **[T1562.012 - Impersonate Legitimate Service/Tool]**: Mimicking well-known VPN brands.
- **[T1548.006 - Browser Extensions]**: Use of malicious extensions to maintain presence and control.
- **[TA0011 - Command and Control]**
- **[T1090.002 - External Proxy]**: Routing traffic through actor-controlled SOCKS5 proxies.
- **[T1568.002 - DNS-over-HTTPS]**: Hiding proxy infrastructure queries.
## Functionality
### Core Capabilities
- **Traffic Redirection:** Configures the browser to route all web traffic through actor-operated SOCKS5 proxies on port 1082.
- **Brand Impersonation:** Uses the logos, names, and descriptions of trusted services like ExpressVPN, Surfshark, and Cloudflare 1.1.1.1 to deceive users.
- **Data Interception:** Positioned to read destination URLs, TLS Server Name Indication (SNI) values, source IPs, and unencrypted (HTTP) request bodies.
### Advanced Features
- **Stealth Infrastructure:** Resolves proxy hostnames via Google or Cloudflare DNS-over-HTTPS (DoH) to bypass local network filtering and prevent domain analysis.
- **Dynamic Configuration:** Fetches remote configurations after extension approval to update proxy settings and bypass static store reviews.
- **Monetization/Fraud:** Advertises "Premium" servers in various countries to facilitate subscription fraud, even though the backend infrastructure is non-functional or misleading.
## Indicators of Compromise
- **File Hashes:** Specific extension CRX hashes vary across 737+ variants (refer to Socket.dev dataset for full list).
- **Network Indicators:**
- `SOCKS5` Proxy Port: `1082`
- DNS: Use of `https://dns[.]google/dns-query` or `https://cloudflare-dns[.]com/dns-query` within the extension context to resolve non-standard proxy domains.
- **Behavioral Indicators:**
- Unexpected modification of Chrome's proxy settings (`chrome.proxy` API).
- High volume of traffic to unknown SOCKS5 nodes immediately after extension installation.
- Presence of extensions from 40 specific malicious publisher accounts using shared analytics IDs.
## Associated Threat Actors
- **Unknown:** Likely a Russian-speaking entity, given the targeting of Russian users and the funneling of traffic toward Russian-based subscription services.
## Detection Methods
- **Signature-based detection:** Identifying the unique Chrome Extension IDs associated with the campaign.
- **Behavioral detection:**
- Monitoring for unauthorized `chrome.proxy` API calls.
- Auditing browser extensions that request the `proxy` and `webRequest` permissions simultaneously.
- **Network Analysis:** Detecting persistent SOCKS5 connections over port 1082 from endpoint browser processes.
## Mitigation Strategies
- **Prevention measures:**
- Implement an **Extension Allowlist** via Group Policy (GPO) to prevent the installation of unapproved browser add-ons.
- Educate users to download VPN clients only from official vendor websites rather than browser web stores.
- **Hardening recommendations:**
- Utilize **Browser Management** tools (Chrome Enterprise) to block extensions by ID or permission set.
- Monitor for DNS queries to DoH providers from unexpected local processes.
## Related Tools/Techniques
- **Adware/Search Hijackers:** Frequently use similar extension-based persistence.
- **SOCKS5 Botnets:** Used for residential proxy relaying.
- **Subscription Fraud/Scareware:** Tactics used to trick users into paying for non-existent services.