Loading story…
Researchers uncovered a large Chrome Web Store campaign in which 737 browser extensions posing as free VPN and proxy tools redirected user traffic through attacker-controlled SOCKS5 infrastructure. The extensions were tied to at least 40 developer accounts and had accumulated more than 75,000 installs, with many lures targeting Russian-speaking users seeking access to blocked or restricted online services. Investigators found that numerous listings impersonated legitimate VPN and privacy brands to gain trust.
The malicious extensions exposed users to surveillance by allowing operators to observe browsing destinations, connection metadata, source IP addresses, and potentially unencrypted HTTP traffic while victims believed their sessions were protected. Researchers also reported the use of encrypted DNS and remote configuration to hide or rapidly change backend infrastructure, and said some advertised premium servers or features did not function as claimed. Google had removed 221 of the identified extensions at the time of reporting, but 516 remained available, underscoring the scale and persistence of the campaign.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
In early June, Palo Alto Networks reported more than 18 fraudulent VPN extensions for Chrome and other Chromium-based browsers. The disclosure predated the broader 737-extension campaign mapping later reported by Socks/Socket.dev.
Researchers said artifacts from the malicious Chrome extension campaign suggest the operator runs a subscription VPN business in Russia. Supporting details included a 12-digit tax number, exposed Windows build paths, and internal instructions indicating deliberate efforts to evade Chrome Web Store review.
At the time Socket.dev collected its data, Google had removed 221 extensions associated with the campaign. Despite those removals, 516 campaign-linked extensions were still available in the Chrome Web Store, indicating the operation remained active.
Socket.dev identified a campaign of 737 Chrome extensions across at least 40 developer accounts that marketed themselves as free VPN or proxy tools while routing browser traffic through attacker-controlled SOCKS5 proxies. The researchers reported more than 75,000 combined installs and widespread impersonation of legitimate VPN and privacy brands.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 87 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
9 references tracked. Mallory keeps watching after this page renders.
heise.de
Open sourcemkd-cirt.mk
Open sourcexakep.ru
Open sourcebleepingcomputer.com
Open sourcetrojan-killer.net
Open sourcethehackernews.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcesocket.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers compromised several legitimate Chrome extensions by phishing developers’ Google Account credentials and then using those accounts to push malicious updates through the Chrome Web Store. Proofpoint reported that affected extensions included **Web Developer** (`0.4.9`), **Chrometana**, **Infinity New Tab**, **CopyFish**, **Web Paint**, and **Social Fixer**, with **TouchVPN** and **Betternet VPN** also likely impacted. Because the updates came from trusted publisher accounts, the malicious code was delivered to existing users as if it were a normal extension release. The injected code delayed execution after installation, retrieved additional payloads from **DGA-generated domains**, and then manipulated browser activity to hijack traffic, replace advertisements, display fake repair alerts, and redirect victims to affiliate programs. Researchers also identified credential-theft components in the campaign, including scripts intended to steal and exfiltrate **Cloudflare** credentials, showing that the operation combined ad fraud, traffic interception, and account compromise in a broad extension hijacking spree.
Aug 14, 2026
Researchers uncovered a coordinated campaign involving **108 malicious Chrome extensions** on the Chrome Web Store that collectively reached about **20,000 installs** and were published under **five separate publisher identities**. The extensions posed as legitimate tools and games but were tied to a shared command-and-control infrastructure, including `cloudapi[.]stream` and backend systems hosted at `144.126.135[.]238`. Investigators linked the operation through reused code, shared privacy-policy artifacts, common Google Cloud project numbers across **54 OAuth-enabled extensions**, and Russian-language comments, indicating a single operator or centrally managed service. The extensions were found stealing **Google account identity data**, **browsing information**, and **Telegram Web sessions**, while some also injected ads, inserted arbitrary JavaScript into visited pages, stripped security headers from sites such as YouTube, TikTok, and Telegram, or used a startup backdoor to open arbitrary URLs. The most severe sample, **Telegram Multi-account**, reportedly exfiltrated Telegram Web session data every 15 seconds and could enable full account takeover by replacing a victim's local session with attacker-supplied data. Researchers said the infrastructure appeared consistent with a **malware-as-a-service** model and warned that many of the extensions were still live when reported; affected users were urged to remove the extensions and revoke active Telegram Web sessions.
Jun 29, 2026
Two Chrome extensions named "Phantom Shuttle" have been discovered masquerading as legitimate VPN or network speed testing tools while secretly intercepting user web traffic and exfiltrating sensitive credentials. Distributed through the Chrome Web Store since at least 2017, these extensions have deceived over 2,180 users, primarily targeting developers and foreign trade workers, by offering paid subscriptions and functional proxy services that create a false sense of legitimacy. The threat actor behind the scheme, using the email theknewone.com@gmail[.]com, published both variants, which operate identically despite different appearances. The extensions employ a sophisticated credential injection mechanism, automatically inserting hardcoded proxy credentials (`username: topfany`, `password: 963852wei`) into every HTTP authentication request, thereby redirecting all browsing traffic through attacker-controlled proxy servers. This enables a persistent man-in-the-middle attack, with all user activity and credentials continuously exfiltrated to a command-and-control server at `phantomshuttle[.]space`. The malicious code is hidden within modified JavaScript libraries, specifically a tampered `jquery-1.12.2.min.js`, and the extensions maintain regular communication with the C2 server. Despite takedown requests, the extensions remain active on the Chrome Web Store as of late December 2025.
Jun 29, 2026