Overview
Security researchers at Socket's Threat Research Team have uncovered a massive malicious campaign on the Chrome Web Store: 737 fake VPN extensions silently routing users' entire browser sessions through attacker-controlled SOCKS5 proxy infrastructure. The campaign, linked to a Russian VPN business called Myxa VPN, impersonated 66 legitimate VPN brands and accumulated over 75,000 installs before Socket reported the findings to Google.
Scale of the Campaign
The campaign stands out for its sheer volume and coordination:
- 737 extensions identified across at least 40 Chrome Web Store developer accounts
- 75,486 combined installs recorded at time of discovery
- 516 extensions were still live with 58,318 active installs
- 274 extensions explicitly impersonated 66 recognized VPN brands
- Only 221 extensions had been removed by publication time
Brands impersonated include Proton VPN, NordVPN, Surfshark, ExpressVPN, CyberGhost, Windscribe, TunnelBear, Cloudflare 1.1.1.1, Google Outline, and AmneziaVPN — all chosen to exploit user trust in known security tools.
How the Attack Works
The mechanism is technically straightforward but devastatingly effective:
SOCKS5 proxy hijacking via Chrome extension API:
When a user clicks "Connect" in one of these extensions, the chrome.proxy.settings API is invoked to route all non-loopback browser traffic through a fixed SOCKS5 endpoint on port 1082, controlled by the threat actor. This places the attacker in a full adversary-in-the-middle (AiTM) position.
Socket researchers found that 520 of 522 retrieved extensions used the exact same hardcoded SOCKS5 configuration — a clear indicator of centralized infrastructure and a single threat actor.
DNS-over-HTTPS to evade detection:
104 extensions used DNS-over-HTTPS (via Cloudflare or Google DoH services) to resolve proxy hostnames to raw IP addresses, making the underlying proxy infrastructure significantly harder to block via conventional network filtering.
The premium server scam:
None of the 200 tested "premium" server hostnames — advertised across Japan, Singapore, Canada, Australia, and Turkey — returned a valid DNS A record. The extensions' entire premium tier was fake, functioning purely as a monetization lure while the proxy routing operated silently.
Post-Approval Code Substitution
A critical piece of the attack was bypassing Chrome Web Store review. The researchers found evidence that these extensions used post-approval code substitution — submitting benign code for review, then swapping in the malicious proxy logic after approval. Multiple accounts submitted identical review justifications, suggesting an automated pipeline to game the review process at scale.
Attribution: Myxa VPN
Socket's researchers traced the campaign to Myxa VPN (Муха VPN), a Russian VPN subscription business. Attribution relied on:
- Extension code analysis revealing shared build artifacts
- Domain registration records cross-referencing extension infrastructure
- Analytics identifiers consistent across accounts
- Internal Russian-language build manuals leaked in extension packages
The campaign primarily targets Russian-speaking users attempting to bypass state internet restrictions on services including Instagram, YouTube, and ChatGPT — making this both a privacy threat and an opportunistic credential-theft operation.
What AiTM Position Enables
With traffic routed through the operator's infrastructure, the attacker can observe:
- Source IP addresses — breaking VPN anonymity entirely
- Browsing destinations — full visibility into sites visited
- TLS SNI values — even before decryption, revealing the target domain
- Full HTTP request bodies — including credentials entered on non-HTTPS pages
For users who installed these extensions specifically to protect their privacy from state surveillance, the irony is particularly sharp: the extension was performing surveillance on their behalf.
Recommended Actions
If you use VPN or proxy extensions in Chrome:
- Audit your extensions — open
chrome://extensions/and remove any VPN extensions you don't recognize or haven't used recently - Check proxy settings — open
chrome://settings/system→ "Open your computer's proxy settings" and verify no unexpected SOCKS5 proxy is configured - Rotate credentials — if any affected extension was installed while you entered passwords on HTTP pages, rotate those credentials now
- Install only from vendors' official pages — always navigate to a VPN provider's official website to find their Chrome extension link rather than searching the Web Store directly
- Verify the developer account — legitimate extensions from major VPN providers are published by verified accounts with matching domain emails