Loading story…
Technical research identified 31 Russian-language Chrome extensions marketed as VPNs for accessing blocked services that allegedly share a common codebase and are distributed through three Google accounts linked to similar Gmail addresses. The extensions request broad permissions and retrieve remote proxy auto-configuration (PAC) files, enabling their operator to change proxied destinations and proxy exit infrastructure without releasing an extension update. One extension, Total VPN, was reportedly configured to route all browser traffic through the proxy service.
The research estimated roughly 356,000 installations as of September 18, 2026, including about 200,000 installations of RuTracker VPN. Backup domains reportedly correspond to premium Browsec VPN servers, but no attribution to Browsec or another operator has been established. Organizations should validate the published indicators independently before blocking them and review managed-browser extension inventories for the identified Russian-language VPN offerings, particularly extensions capable of remotely changing PAC configurations.
Trace attribution and downstream blast radius.
4 events from the most recent confirmed update back to the earliest known activity.
Extension IDs, domains, and SHA-256 build hashes were automatically extracted as potential detection indicators. The content cautioned that these IOCs had not been independently verified and required validation before operational blocking or SIEM use.
Risky Plugins published research alleging that 31 Russian-language Chrome VPN extensions were distributed through three related Google accounts and could route selected browser traffic through operator-controlled proxies via remotely updated PAC files. The report characterized infrastructure overlap with Browsec VPN premium servers as an investigative lead, not an attribution.
The research estimated that the 31 Chrome extensions had approximately 356,000 total installations, including about 200,000 for RuTracker VPN. This was an installation-count snapshot rather than an independently verified compromise total.
A Risky Plugins research publication states that its authors analyzed the code and decoded remote configurations of the extensions on September 3 and 4. The analysis identified 31 extensions allegedly sharing a codebase and using remotely retrieved PAC proxy configurations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 32 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers uncovered a large Chrome Web Store campaign in which **737 browser extensions** posing as free VPN and proxy tools redirected user traffic through attacker-controlled **SOCKS5** infrastructure. The extensions were tied to at least **40 developer accounts** and had accumulated more than **75,000 installs**, with many lures targeting Russian-speaking users seeking access to blocked or restricted online services. Investigators found that numerous listings impersonated legitimate VPN and privacy brands to gain trust. The malicious extensions exposed users to surveillance by allowing operators to observe browsing destinations, connection metadata, source IP addresses, and potentially unencrypted HTTP traffic while victims believed their sessions were protected. Researchers also reported the use of encrypted DNS and remote configuration to hide or rapidly change backend infrastructure, and said some advertised premium servers or features did not function as claimed. Google had removed **221** of the identified extensions at the time of reporting, but **516** remained available, underscoring the scale and persistence of the campaign.
Aug 13, 2026
Investigations found that several popular Chrome and Edge extensions collected sensitive user data at scale, including AI chat conversations and browsing activity, often with limited transparency. Reports said extensions such as **Urban VPN**, Stylish, Poper Blocker, SimilarWeb, StayFocusd, CrxMouse, WhatRuns, and StayFree had either directly exfiltrated AI chat content or retained the remote-configurable capability to do so, affecting more than 7 million installs combined; a separate report alleged Urban VPN-related "privacy" extensions monetized data from roughly 8 million users. Researchers also reported that Urban VPN had previously scraped AI conversations and that its user-facing **opt-out of data collection** control was inverted in code, potentially leaving collection enabled even when users believed they had disabled it. Urban VPN was also found to contain a high-severity browser-extension flaw that let any website send privileged `postMessage` commands without origin validation, allowing attackers to disconnect the VPN, reroute traffic, change bypass settings, disable privacy protections, disable competing extensions, and query extension state. The issue was reportedly fixed in **Urban VPN version 5.12.5** by limiting accepted messages to a read-only query, while broader concerns about data collection practices remained. Together, the findings raised concerns that widely installed browser extensions marketed around convenience or privacy could both harvest sensitive content and expose users to direct manipulation of browser security controls.
Aug 21, 2026
Two Chrome extensions named "Phantom Shuttle" have been discovered masquerading as legitimate VPN or network speed testing tools while secretly intercepting user web traffic and exfiltrating sensitive credentials. Distributed through the Chrome Web Store since at least 2017, these extensions have deceived over 2,180 users, primarily targeting developers and foreign trade workers, by offering paid subscriptions and functional proxy services that create a false sense of legitimacy. The threat actor behind the scheme, using the email theknewone.com@gmail[.]com, published both variants, which operate identically despite different appearances. The extensions employ a sophisticated credential injection mechanism, automatically inserting hardcoded proxy credentials (`username: topfany`, `password: 963852wei`) into every HTTP authentication request, thereby redirecting all browsing traffic through attacker-controlled proxy servers. This enables a persistent man-in-the-middle attack, with all user activity and credentials continuously exfiltrated to a command-and-control server at `phantomshuttle[.]space`. The malicious code is hidden within modified JavaScript libraries, specifically a tampered `jquery-1.12.2.min.js`, and the extensions maintain regular communication with the C2 server. Despite takedown requests, the extensions remain active on the Chrome Web Store as of late December 2025.
Jun 29, 2026