Chrome VPN Extensions Found Hijacking Browser Traffic
Hundreds of malicious Chrome extensions disguised as VPNs were discovered routing user traffic through proxy servers. Security researchers flagged these tools as high-risk for data interception.
TL;DR
- 737 suspicious Chrome extensions impersonating VPNs were found in the wild.
- These extensions targeted Russian-speaking users to bypass local blocks.
- Over 75,000 installs were recorded before detection.
- Extensions routed traffic through proxy infrastructure, risking data exposure.
- Organizations should audit browser extensions for potential threats.
Security researchers have uncovered a widespread campaign involving 737 malicious Chrome extensions posing as legitimate VPN services. These extensions, many targeting Russian-speaking users, were designed to reroute browser traffic through proxy servers, potentially exposing sensitive data.
With over 75,000 installations detected, the scale of this operation raises serious concerns for both individual privacy and organizational security. The deceptive nature of these extensions underscores the importance of vetting third-party browser add-ons, especially within enterprise environments where data protection is critical.
How the Malicious Extensions Operated
- The extensions mimicked popular VPN functionalities but secretly redirected traffic without user knowledge.
- They used at least 40 different developer accounts to publish across the Chrome Web Store.
- Traffic was routed through centralized proxy infrastructure, increasing interception risk.
- Some extensions impersonated well-known brands to gain user trust and avoid suspicion.
Impacts and Recommendations for Enterprises
- Enterprises face risks from unmonitored data leakage via compromised browser sessions.
- IT teams should review installed browser extensions and enforce allowlists.
- Regular audits of endpoint browsers can help detect unauthorized or malicious add-ons.
- Employee training on extension safety can reduce accidental installation of harmful tools.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.