Socket researchers have uncovered a sprawling network of 737 Chrome VPN extensions that impersonated legitimate privacy brands, redirected browser traffic through shared SOCKS5 infrastructure, and accumulated more than 75,000 installs.
The campaign primarily targeted Russian-speaking users looking for ways to access blocked services such as Instagram, YouTube, and ChatGPT.
Socket’s Threat Research Team identified extensions spread across at least 40 Chrome Web Store developer accounts and recovered code for 525 of them. Of the 522 extensions examined in the main code corpus, 520 configured Chrome to send browser traffic through infrastructure associated with the same operation.
Socket researchers used extension code, store listings, domain registration records, analytics identifiers, leaked build artifacts, and public infrastructure data to link the extensions to a Russian VPN subscription business operating under the name Myxa VPN, or Муха VPN.
According to Socket, 274 extensions impersonated 66 established VPN and privacy brands, including Proton VPN, NordVPN, Surfshark, ExpressVPN, CyberGhost, Windscribe, TunnelBear, Cloudflare’s 1.1.1.1, Google Outline, AmneziaVPN, and AntiZapret. Those impersonating legitimate services accounted for more than 38,000 installs.
Once connected, 520 extensions configured chrome.proxy.settings to route nearly all browser traffic through SOCKS5 proxies on port 1082, excluding only local loopback addresses. This put the proxy operator in a position to observe users’ destination hosts, TLS SNI information, source IP addresses, and the full contents of unencrypted HTTP traffic.
Socket
Socket stressed that it analyzed only the client side and found no evidence establishing what the proxy servers actually logged or transmitted.
A subset of 104 extensions also attempted to make their proxy infrastructure harder to block. They resolved proxy hostnames using Cloudflare or Google DNS-over-HTTPS services and supplied Chrome with the resulting raw IP address, preventing the local system from making a normal plaintext DNS request for the campaign’s domains.
Researchers also uncovered an internal Russian-language build manual instructing developers not to place proxy domains directly in chrome.proxy.settings, but to resolve them to IP addresses first. Another 66 extensions could follow HTTP redirects to discover new infrastructure and download configuration from domains not included in the published package.
The operation also promoted paid servers in Japan, Singapore, Canada, Australia, and Turkey. Socket tested 200 premium hostnames across 40 domains and found that none returned an A record. Some extensions also contained broken or trivially bypassed licensing systems, while one extension, marketed as “Burёnka VPN,” was hardcoded so that every connection attempt failed.
Evidence tying the extensions together included identical code-generation markers, shared analytics accounts, synchronized domain registrations, common hosting infrastructure, and leaked Windows build paths referencing a myxa-work project directory.
Google had removed 221 of the 737 extensions by the time Socket collected its data, but 516 remained listed, representing 58,318 installs.
Users who installed one of the affected VPN extensions should remove it, verify that Chrome’s proxy configuration has returned to normal, and change credentials submitted through non-HTTPS websites while the extension was active.
Leave a Reply