Socket Links 737 Chrome “VPN” Extensions to One Proxy Operation—Here Are 25 IDs to Check

Deck: The extensions amassed 75,486 bucketed installs, routed browser traffic through shared SOCKS5 infrastructure, impersonated established privacy brands and repeatedly returned after store removals.

Reporting cutoff: 2026-08-24T12:03:13Z

An independent investigation by Socket’s Threat Research Team has linked 737 Chrome Web Store VPN and proxy extensions to a coordinated operation that targeted primarily Russian-speaking users seeking access to blocked services.^[1]

Socket reports that the extension estate used at least 40 developer accounts and accumulated 75,486 installs. Its researchers analyzed executable code from 525 extensions, including 522 retrieved in bulk and three found during store enumeration.^[1]

The headline number needs context: Chrome Web Store install figures are displayed in buckets, so 75,486 is a sum of public buckets—not an exact count of unique people.^[1]

What Socket actually found

The report describes three connected behaviors:

1. Traffic interception: 520 of 522 bulk-retrieved packages configured Chrome to send the user’s browser session through a fixed SOCKS5 proxy on port 1082.^[1]
2. Detection evasion: 104 extensions resolved their own proxy domains through Cloudflare or Google DNS-over-HTTPS services and supplied Chrome with raw IP addresses, avoiding a normal plaintext DNS lookup for the campaign domain.^[1]
3. Subscription deception: paid tiers advertised 200 server hostnames in Japan, Singapore, Canada, Australia and Turkey; Socket said none of those tested hostnames resolved.^[1]

The Hacker News and Bitdefender separately summarized the same Socket findings and counts.^[3][6]

The numbers—and their denominators

Socket’s report separates several populations that should not be collapsed:

• 737 extensions attributed to the campaign;
• 734 present in Socket’s source dataset;
• 3 additional extensions found during store enumeration;
• 525 packages retrieved and analyzed;
• 522 bulk-retrieved packages used as the denominator for code-level figures;
• 520 of 522 that configured a proxy;
• 516 listed as active when the corpus was collected;
• 221 already removed by that point;
• 212 known only from listing-level evidence because their packages had been removed before retrieval;
• 75,486 bucketed installs across the 737;
• 58,318 bucketed installs attached to the 516 then-active extensions.^[1]

Our extraction found 736 distinct extension IDs linked directly in the Socket report’s HTML. Socket reports 737 campaign extensions, so we did not guess or manufacture the one unlinked/missing ID.

What “traffic interception” means

A Chrome extension with the proxy permission can direct browser traffic through an operator-controlled proxy. Socket says 520 extensions configured a fixed SOCKS5 relay with a bypass list containing only loopback addresses, meaning other browser destinations were routed through the proxy while the extension was connected.^[1]

That position can expose:

• the user’s source IP address;
• destination hosts;
• TLS Server Name Indication values;
• timing and connection metadata;
• complete contents of requests sent over plain HTTP.^[1]

A crucial boundary: Socket examined the client-side extension code. It did not claim to know what the proxy operator retained or transmitted.^[1]

The report also does not establish that the proxies could automatically decrypt properly protected HTTPS page content. HTTPS still matters. The risk is that the proxy sits in the traffic path, sees significant metadata, and can read anything sent without end-to-end encryption.

These were browser proxies—not full-device VPNs

Socket describes the extensions as fixed SOCKS5 browser proxies. They did not provide a full operating-system VPN tunnel, did not add encryption of their own and did not protect operating-system DNS or non-Chrome application traffic.^[1]

That does not make the risk smaller. It makes the marketing more misleading: users installed something presented as a privacy tool, while the browser placed the operator directly in the path of the traffic those users most wanted to protect.

Brand impersonation

Socket says 274 extensions, representing 38,140 installs, impersonated 66 established VPN and privacy brands. Examples included Proton VPN, NordVPN, Surfshark, AdGuard VPN, Browsec, ExpressVPN, CyberGhost, Windscribe, TunnelBear, Cloudflare’s 1.1.1.1 and Google’s Outline.^[1]

Two especially sensitive targets were AmneziaVPN and AntiZapret—services used by people attempting to bypass censorship or surveillance.^[1]

A familiar name, logo or five-star rating in a store listing is therefore not enough. The publisher and exact extension ID must match the provider’s official website.

How the campaign evaded simple blocking

The report says 104 extensions used DNS-over-HTTPS to resolve campaign proxy hostnames and then passed the resulting raw IP address to Chrome. That can defeat defenses that rely only on seeing or blocking a normal DNS query for the malicious hostname.^[1]

Socket also found:

• 66 extensions that followed redirects to locate current configuration infrastructure;
• 49 extensions across 18 publisher accounts that received post-approval code updates;
• 31 of those updated extensions still listed as live at collection time;
• identical or nearly identical privacy justifications submitted from multiple publisher accounts;
• source comments discussing how to respond if Chrome Web Store review rejected a behavior;
• a published internal build manual instructing staff to give Chrome a resolved IP instead of putting the domain directly into proxy settings.^[1]

The operation behind the extensions

Socket assessed that the 737 extensions belonged to one operation based on shared code, infrastructure, build paths, analytics accounts, registration timing and self-identifying strings inside the extensions.^[1]

The researchers linked the estate to a Russian subscription VPN business branded “Муха VPN” or “myxa VPN.” They found a public contract naming a self-employed taxpayer and confirmed that the tax identifier represented an active registration.^[1]

Socket did not identify or accuse a specific individual, and found no evidence of Russian state sponsorship or tasking.^[1]

One extension was entirely fake

Socket reported that ilpcglpcfdeoehcmjhkfhhgpldgfgjhj, listed as Burёnka VPN, contained a polished interface and advertised servers in seven countries—but its server entries pointed to a non-routable address and every connection attempt failed.^[1]

This example supports a broader point: an attractive interface and active store listing do not prove a security product performs the service it advertises.

25 extension names and IDs found in the report

We extracted 736 IDs directly from the primary Socket report and performed a bounded public metadata check against the Chrome Web Store. The following 25 IDs appeared in the Socket report, and their listing titles were visible during our check at 2026-08-24T12:03:13Z.

Do not use this as an installation list. Compare the IDs with chrome://extensions for audit and removal. Store names, availability and displayed user buckets can change.

The exact titles above are evidence of listing metadata—not proof that the genuine companies behind similar names published or endorsed these extensions.

The packet also includes all 736 IDs linked from the primary report in a machine-readable defensive inventory.

What affected users should do

1. Remove a matching extension by ID

Open Chrome’s extension-management page and compare the 32-character ID, not just the name or icon. Google’s instructions direct users to Chrome’s Extensions management area to turn off or remove extensions.^[4]

If you find a matching ID, remove it. Do not reinstall it from a search result or store listing.

2. Confirm proxy settings returned to normal

After removal, restart Chrome and check its proxy/network settings. Socket specifically recommends confirming that Chrome’s proxy configuration returned to normal.^[1]

Google notes that extensions affecting lower-level VPN or proxy access are not controlled by ordinary per-site read/change permission settings.^[4] Removing site access alone is therefore not enough.

3. Review every Chrome profile and managed device

Check each Chrome profile, synchronized browser and managed endpoint. An extension may exist in one profile and not another.

4. Change credentials exposed over plain HTTP

Socket recommends changing credentials entered on non-HTTPS sites while a listed extension was connected.^[1] If a high-value account behaved unexpectedly, rotate that password as a precaution, revoke active sessions and enable multifactor authentication.

5. Verify the legitimate provider independently

Reach a VPN provider through its known official website and follow that company’s own extension link. Confirm the developer, exact ID, privacy policy and support domain.

What businesses should do

• Inventory Chrome extensions by extension ID across managed browsers.
• Compare installed IDs against the 736-ID defensive inventory.
• Block confirmed campaign IDs and remove them from managed profiles.
• Review extensions requesting proxy with the same seriousness as broad site access.
• Alert on changes to chrome.proxy.settings.
• Inspect egress for unexpected SOCKS5 traffic on port 1082.
• Do not rely only on DNS-domain blocks; 104 extensions used DNS-over-HTTPS and raw proxy IPs.^[1]
• Require an allowlist for privacy, VPN and proxy extensions.
• Preserve relevant browser policy, extension package, proxy and network evidence before cleanup.

Google’s enterprise documentation allows administrators to control which extensions users may install through extension policies.^[5]

Google’s response and the enforcement gap

Socket reported that Google had removed 221 of 737 extensions while 516 remained listed as active when the corpus was collected.^[1]

That was a point-in-time measurement, not today’s guaranteed store state. We sampled 150 report-linked IDs during this research and found 125 pages still returning a non-generic listing title, but that sample is not a replacement for a complete current store census.

Socket also found that publishers often continued releasing extensions after earlier removals. The economics were inexpensive: at $5 per Chrome Web Store developer account, the source dataset’s 38 accounts represented $190 in account fees.^[1]

What remains unknown

The report does not establish:

• an exact number of unique human users;
• what the proxy operator logged, retained or shared;
• whether properly encrypted HTTPS content was decrypted;
• the identity of an individual operator;
• state sponsorship;
• the complete current live/removed status of all 737 extensions;
• whether every listed extension behaved identically in every version;
• the missing/unlinked extension ID required to reconcile 736 linked IDs with the 737 campaign count.

Bottom line

This campaign exploited a trust shortcut: users assumed that a familiar VPN name, polished interface or Chrome Web Store listing meant the extension was safe.^[1]

The strongest defense is to verify the exact publisher and extension ID through the provider’s official website, keep browser extensions to a minimum, and treat the proxy permission as a high-impact network-control capability.

Safety note: The article provides extension IDs for defensive comparison but no direct installation links, proxy credentials, live campaign infrastructure, or instructions to reproduce the traffic-routing behavior.

Sources

1. Socket — 737 Chrome VPN extensions campaign

   “Socket's Threat Research Team identified a campaign of 737 free VPN and proxy extensions published across at least 40 Chrome Web Store developer accounts, 274 of which impersonate 66 established VPN and privacy brands, that route the user's entire browser session through SOCKS5 proxies operated by a single provider.”

   “The campaign has accumulated 75,486 installs across 737 extensions, of which 516 were listed as active when the corpus was collected, carrying 58,318 installs.”

   “Socket observed the client side only. The extensions place the threat actor in a position to read all browser traffic, and this report makes no claim about what the proxy servers retain or transmit.”

   “520 of the 522 retrieved packages set chrome.proxy.settings to a fixed SOCKS5 server on port 1082 with a bypass list containing only loopback addresses, placing the threat actor in an adversary-in-the-middle position over all browser traffic.”

2. gHacks — fake VPN extension report summary

   “Socket's threat research team analyzed 737 suspicious extensions that claimed to offer VPN and SOCKS5 proxy services. These were published under 40 developer accounts and had a combined 75,486 installs.”

3. The Hacker News — 737 Chrome VPN extensions

   “A massive set of 737 free VPN and proxy extensions have been found to mainly target Russian-speaking users seeking access to blocked services with an aim to intercept browser traffic and route them through a proxy infrastructure.”

4. Google Chrome — install and manage extensions

   “On your computer, open Chrome. At the top right, select More Extensions Manage extensions.”

   “Extensions that change lower-level network access through VPNs or proxy settings aren’t affected by the change in permissions.”

5. Google Chrome Enterprise — extension policies

   “As an administrator, you can automatically install Chrome apps and extensions on users' computers. You can also control which apps or extensions users can install.”

6. Bitdefender — fake Chrome VPN extension coverage

   “Socket linked 737 Chrome VPN and proxy extensions to the campaign, which collectively accumulated 75,486 installs”