A widespread operation involving 737 free VPN and proxy extensions has been identified, primarily aimed at Russian-speaking users attempting to access geo-blocked services. The primary objective of these extensions was to intercept browser traffic and route it through a malicious proxy infrastructure. Published across at least 40 **Chrome Web Store** developer accounts, these fraudulent extensions amassed 75,486 installs. Of those, 274 were found to impersonate 66 established VPN and privacy brands, including **Proton VPN**, **NordVPN**, **Surfshark**, **AdGuard VPN**, **Browsec**, **ExpressVPN**, **CyberGhost**, **Windscribe**, **TunnelBear**, **Cloudflare's 1.1.1.1**, and **Google's Outline**, according to research by **Socket**. ### Adversary-in-the-Middle Position Security researcher **Kush Pandya** stated that these censorship circumvention extensions "route the user's entire browser session through SOCKS5 proxies operated by a single provider." A significant 520 out of 522 extensions analyzed in the bulk corpus were found to funnel browser traffic through the same **SOCKS5** infrastructure.  The vast majority of these extensions rerouted users' entire browser sessions by configuring `chrome.proxy.settings` to a fixed SOCKS5 server on port 1082. This setup placed the threat actor in an **adversary-in-the-middle (AitM)** position, enabling them to observe browser destinations, source IP addresses, **TLS SNI** values, and any request body sent over plain HTTP. Every extension that configured a proxy also included a bypass list limited to loopback addresses (i.e., `localhost` or `127.0.0.1`). This meant that every other browser request was funneled through the SOCKS5 relay on port 1082 once a user connected to the purported VPN service. ### Red Flags and Removal Efforts As many as 221 browser add-ons have since been removed from the Chrome Web Store, though 516 extensions remained active at the time of the report. The threat actor is believed to be operating a subscription VPN business in Russia, evidenced by a 12-digit taxpayer number and leaked Windows build paths within some extensions. While the functionality might appear similar to legitimate VPN or proxy services, the defining characteristic of this activity is the deliberate impersonation of established brands. Other red flags identified include: * Advertising paid tiers or premium locations that do not exist. * Evasion of **DNS-over-HTTPS** blocklists. * Displaying fake interfaces with connecting animations and status indicators, despite failing every connection attempt. * Shipping an internal manual, "Промт для сотрудников" (Prompt for employees), instructing staff on how to avoid direct domain use in `chrome.proxy.settings` and to prevent using domains from other extensions without specific instructions. * Presence of comments indicating intentional evasion of Chrome Web Store policies. * Addition of a new remote-configuration layer post-extension approval. * Attempts to manipulate the Chrome Web Store review process by submitting identical, false justifications such as "No data transmitted to external servers" or "No user tracking or logging."  "For each affected user, while the extension is connected, every request passes through a server the threat actor controls," Pandya elaborated. "Whether the threat actor owns those proxy servers or resells capacity from an upstream provider is not resolvable from the extension code. If it resells, a further party is in the same position." ### Removed Chrome Extension Resurfaces with Monetization Scheme This discovery coincides with **Netskope Threat Labs** highlighting the reappearance of a Google Chrome extension named "**AI Sidebar with Deepseek, ChatGPT, Claude, and more**." This extension had previously been removed for engaging in "Prompt Poaching" tactics. The extension's update sequence, distributed via **Google's CRX** content delivery network on July 31, 2026, saw a "clean-then-poisoned" approach across versions 1.7.2.0 and 1.7.3.0. A "surgical" 21-line addition introduced a monetization scheme tied to extension update and uninstall events. "The extension released a benign update removing the data theft code and acknowledged its wrongdoing. After 2 weeks, it pulled the rug again with a new update," **Netskope** stated. "While it no longer contains the conversation-exfiltration code, it now contains a monetization payload that opens an affiliate link in a foreground browser tab every single time the extension updates and uninstalls. Additionally, it suppresses the redirection of DeepSeek users to ChatGPT." These incidents underscore the persistent challenges in maintaining security and privacy within browser extension ecosystems, requiring constant vigilance from users and developers alike.