Security researchers have identified 737 free VPN and proxy extensions in the Chrome Web Store that primarily target Russian-speaking users seeking access to blocked services. The extensions, published across at least 40 developer accounts, have accumulated approximately 75,486 installs. Once installed, the extensions intercept browser traffic and route it through attacker-controlled proxy infrastructure, enabling potential traffic interception and data theft. Of the identified extensions, 274 have been found to impersonate 66 legitimate services. Google Chrome is the affected platform.

What should defenders do?

Users should immediately review their installed Chrome extensions and remove any suspicious VPN or proxy tools. Avoid installing untrusted extensions. Google Chrome users are advised to audit extension lists and be cautious of extensions offering free VPN or proxy services, especially those impersonating legitimate brands.

highMalware

737 Malicious Chrome VPN and Proxy Extensions Intercepting Browser Traffic Discovered

Over 75,000 installs reported; extensions route traffic through attacker-controlled proxies targeting Russian-speaking users

CyberIntel DeskPublished about 1 month agoUpdated less than a minute ago1 min read

737 Malicious Chrome VPN and Proxy Extensions Intercepting Browser Traffic Discovered

Key Takeaways

737 malicious VPN and proxy extensions identified in the Chrome Web Store.
Over 75,000 total installs reported across the affected extensions.
Extensions primarily target Russian-speaking users seeking access to blocked services.
274 extensions impersonate 66 legitimate VPN/proxy services.

Related Security News

highData Breaches

Times Car Confirms Data Breach Affecting 6.6 Million User Accounts

Times Car, a Japanese car-sharing service, has confirmed a data breach compromising approximately 6.6 million user accounts. The incident was disclosed late last week, with the exact attack vector and nature of exposed personal information yet to be fully specified. Authorities and the company are reportedly investigating the breach.

BleepingComputerabout 4 hours ago1 min read

highCyber Attacks

Star Blizzard Campaign Targets 100+ Organizations with Fake Event Invitations

Microsoft reports that the Russian state-sponsored threat actor Star Blizzard has been conducting a sustained campaign since January 2026, using fake event invitations to trick targets into installing a backdoor on Windows computers. The operation has affected more than 100 organizations, primarily in the U.S. and U.K., with victims tied to Ukraine. At least one infection has been confirmed, though the full extent of breaches and data exfiltration remains unverified.

The Hacker Newsabout 5 hours ago1 min read