Socket finds 737 Chrome VPN extensions routing traffic through single SOCKS5 proxy

AI digestMimile.ai EditorialAugust 12, 2026 at 07:09 PM

This digest was compiled by AI from multiple sources — links to the originals are below.

Socket finds 737 Chrome VPN extensions routing traffic through single SOCKS5 proxy

Socket identifies 737 free VPN and proxy Chrome extensions that route users' browser sessions through a single SOCKS5 proxy on port 1082. The extensions, published across at least 40 Chrome Web Store developer accounts, accumulated 75,486 installs, and 274 impersonated 66 established VPN brands including Proton VPN, NordVPN and Surfshark. 221 have been removed from the Chrome Web Store, while 516 remain active.

Impersonation Campaign

Socket catalogued 737 free VPN and proxy extensions across at least 40 Chrome Web Store developer accounts, with 75,486 total installs. Of these, 274 posed as 66 established privacy brands — Proton VPN, NordVPN, Surfshark, AdGuard VPN, Browsec, ExpressVPN, CyberGhost, Windscribe, TunnelBear, Cloudflare's 1.1.1.1, and Google's Outline. Some extensions advertised paid tiers or premium locations that do not exist. Others displayed a complete fake interface, including a working connection animation and status indicator, while failing every connection attempt.

Proxy Infrastructure

Kush Pandya, a security researcher at Socket, found that 520 of 522 extensions in the bulk corpus route browser traffic through the same SOCKS5 infrastructure. The extensions set chrome.proxy.settings to a fixed SOCKS5 server on port 1082, placing the operator in an adversary-in-the-middle position to observe destinations, source IP addresses, TLS SNI values, and plain HTTP request bodies. A bypass list includes only loopback addresses, meaning every other browser request is funnelled through the relay once the user connects.

Removal and Attribution

Google removed 221 extensions from the Chrome Web Store, while 516 remain listed as active. The threat actor appears to run a subscription VPN business in Russia, based on a 12-digit taxpayer number and leaked Windows build paths pointing to a developer folder 'C:\Users\ollob\OneDrive\Документы\1.myxa-work\08.06.26'. Some extensions shipped an internal manual titled 'Промт для сотрудников' instructing staff not to put the domain directly into chrome.proxy.

What's Next

Chrome Web Store users are advised to review installed VPN and proxy extensions against the list of 737 identified by Socket. It remains unclear whether Google will remove the remaining 516 active extensions or whether the operator will republish them under new developer accounts.

2 sources

Socket finds 737 Chrome VPN extensions routing traffic through single SOCKS5 proxy

thehackernews.com

The Hacker News

bleepingcomputer.com

BleepingComputer

Technology

Russia blocks over 20 VPNs in major internet crackdown

On August 4, Russia's communications regulator Roskomnadzor blocked more than 20 VPN services, causing widespread disruptions for users seeking to bypass internet censorship. Some connectivity was restored by August 5, but the crackdown underscores escalating government efforts to restrict access to independent media. The move coincides with plans by the Ministry of Digital Development to tighten control over corporate VPNs.

Technology

Socket finds 19 Chrome and Edge extensions with crypto-stealing code

Socket researchers identified 19 browser extensions—18 for Chrome and one for Edge—that steal wallet secrets and drain cryptocurrency. The extensions were published over the last six months, with evidence the campaign dates to February 2024. The threat actor acquired five extensions and created 14, pushing malicious updates after gaining users.

Technology

StopAndProtect Campaign Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data

Check Point researchers identify a global cybercrime operation dubbed StopAndProtect that uses nearly 2,000 hacked WordPress sites to distribute malware and steal victim data. The campaign, discovered in mid-May 2026, deploys a toolkit of ransomware, credential stealers, and a lock-screen component while its operators exfiltrate files, screenshots, and activity logs.

Technology

Check Point uncovers StopAndProtect cybercrime ring using 2,000 WordPress sites

Check Point Research uncovered a global cybercrime ring dubbed StopAndProtect that hijacked around 2,000 WordPress sites and infected 5,000 computers. The operation used compromised WordPress installations to deliver malware, conduct surveillance, steal data, and distribute ransomware. The discovery raises concerns about the security of outdated WordPress versions and third-party plugins.

Socket finds 737 Chrome VPN extensions routing traffic through single SOCKS5 proxy

Impersonation Campaign

Proxy Infrastructure

Removal and Attribution

What's Next

Read more

Read more