More than 737 fake Chrome VPN extensions impersonating Proton VPN, NordVPN, Surfshark and ExpressVPN routed users' traffic through SOCKS5 proxies operated by a single provider, researchers at application security company Socket found. The extensions were downloaded nearly 75,000 times, mainly by Russian users seeking to bypass blocked services, and were published through 40 accounts using a shared analytics account.

Socket identified three threat behaviors: 520 extensions configured Chrome to route all browser traffic through the operator's proxies; 104 extensions used DNS-over-HTTPS to hide the proxy destination; and some advertised nonexistent premium servers in Japan, Singapore, Canada, Australia and Turkey for subscription fraud. The researchers said the extensions impersonated established brands, used nonfunctional payment mechanisms and added remote configuration after approval — indicators of intentional deception.

Google removed more than 200 extensions, but over 500 remain available on the Chrome Web Store, Socket reports.