CYBERSECURITYTRACKER
TRACKING7,811 stories in this site build1,697 vulnerability news stories in this site build
Permanent story citation

Hundreds of fake Chrome VPN extensions route traffic through a proxy

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 4310

As cited

Copy frozen at (site build).

threat intel

Hundreds of fake Chrome VPN extensions route traffic through a proxy

Over 737 malicious Chrome extensions impersonated legitimate VPN and proxy services on the Chrome Web Store, instead routing user traffic through SOCKS5 proxies controlled by a single operator. The campaign deceived users seeking privacy tools into exposing their internet activity to an attacker-controlled infrastructure. This represents a systematic abuse of the extension platform to intercept and monitor user traffic at scale.

Why it matters: Enterprise and individual users relying on Chrome extensions for privacy or security are at immediate risk of traffic interception and credential theft; practitioners should audit installed extensions against known impostors and validate VPN authenticity through official channels.

Source published
First seen by Cybersecurity Tracker

Source attribution

Correction

Correction recorded as of .

threat intel

Hundreds of fake Chrome VPN extensions route traffic through a proxy

No summary had been written when this copy was frozen.

First seen by Cybersecurity Tracker

Source attribution

Correction

Correction recorded as of .

threat intel

Hundreds of fake Chrome VPN extensions route traffic through a proxy

Over 737 malicious Chrome extensions impersonated legitimate virtual private network (VPN) and proxy services on the Chrome Web Store, redirecting user traffic through SOCKS5 proxies controlled by a single operator. The extensions deceived users into believing they were installing trusted tools while compromising their network routing.

Why it matters: Chrome users who installed these extensions had their internet traffic intercepted and rerouted, exposing them to potential data exfiltration, credential theft, and man-in-the-middle attacks; security teams should advise users to audit installed extensions and verify VPN software authenticity.

Source published
First seen by Cybersecurity Tracker

Source attribution

Correction

Correction recorded as of .

threat intel

Hundreds of fake Chrome VPN extensions route traffic through a proxy

Over 737 malicious Chrome extensions impersonated legitimate virtual private network (VPN) and proxy services on the Chrome Web Store, redirecting user traffic through SOCKS5 proxies controlled by a single operator. The extensions deceived users into believing they were installing trusted tools while compromising their network routing.

Why it matters: Chrome users who installed these extensions had their internet traffic intercepted and rerouted, exposing them to potential data exfiltration, credential theft, and man-in-the-middle attacks; security teams should advise users to audit installed extensions and verify VPN software authenticity.

VendorsGoogle
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary