Security researchers identified 737 malicious VPN and proxy extensions distributed across the Chrome Web Store, collectively installed over 75,000 times. The extensions targeted Russian-speaking users attempting to bypass regional content restrictions, but instead intercepted and rerouted browser traffic through attacker-controlled proxy infrastructure.

The campaign operated through at least 40 compromised or fraudulent Chrome Web Store developer accounts. Of the 737 extensions analyzed, 274 impersonated legitimate VPN services, creating confusion among users seeking trustworthy privacy tools. This deception layer increased installation rates among users who believed they were downloading established providers.

The extensions functioned as man-in-the-middle proxies. Once installed, they captured unencrypted HTTP traffic and encrypted HTTPS traffic metadata, routing communications through attacker infrastructure. This positioning allowed operators to monitor browsing activity, intercept credentials, and potentially inject malicious content into web pages.

The geographic focus on Russian speakers reflects demand from users circumventing regional blocking of services and websites. However, the targeting expanded beyond privacy circumvention to data harvesting and traffic monitoring, creating risk for credential theft and account compromise.

Google removed the identified extensions from the Chrome Web Store following researcher disclosure. However, users who previously installed these extensions retain them unless manually removed. Active infections persist across systems that haven't updated their browser or reviewed installed extensions.

Users should audit their Chrome extensions immediately by navigating to chrome://extensions/ and removing any unfamiliar VPN or proxy tools. Priority should go to extensions installed during periods when users sought access to blocked services or downloaded VPN tools outside official publisher channels.

The incident demonstrates how threat actors exploit legitimate user demand for privacy and circumvention tools. Free VPN extensions remain a persistent attack vector due to minimal verification on app distribution platforms and user willingness to grant broad permissions. Organizations should implement browser extension policies restricting installation to approved security vendors and