Socket’s Threat Research Team has identified 737 free VPN and proxy extensions in the Chrome Web Store that route users’ entire browser sessions through proxy infrastructure controlled by a single operator. The extensions were published across at least 40 developer accounts and accumulated 75,486 installs, according to research published by security researcher Kush Pandya.
The campaign primarily targeted foreign users seeking access to blocked services including Instagram, YouTube, and ChatGPT.
The extensions use a documented Chrome capability. They write a proxy configuration into chrome.proxy.settings, directing the browser to a fixed SOCKS5 server on port 1082.
Each extension’s bypass list — the set of destinations exempted from the proxy — contains only loopback addresses, `localhost` and `127.0.0.1`. All other requests traverse the relay once a user activates the connection. That configuration places the operator in an adversary-in-the-middle position with visibility into destination domains, the user’s originating IP address, TLS SNI values that expose hostnames on encrypted connections, and the full contents of any request still sent over plain HTTP.
Socket recovered code for 525 extensions. Of the 522 packages in the main analysis corpus, 520 pointed at the same SOCKS5 infrastructure.
Socket states the limits of its evidence directly. The research examined client-side extension code, store listings, domain registration records, analytics identifiers, and public infrastructure. It establishes that the operator occupied a position from which the traffic could be observed. It does not establish what the proxies logged or retained. Pandya notes that whether the operator owns the proxy servers or resells capacity from an upstream provider cannot be resolved from the extension code; if it resells, an additional party occupies the same position. Socket also notes that proxying traffic is not itself evidence of malicious behaviour, as legitimate browser VPN tools use the same mechanism.
Socket found 274 of the extensions impersonating 66 established VPN and privacy brands, including Proton VPN, NordVPN, Surfshark, ExpressVPN, CyberGhost, Windscribe, TunnelBear, AdGuard VPN, Browsec, AmneziaVPN, Cloudflare’s 1.1.1.1, and Google’s Outline.
Socket links the extensions to a VPN subscription business operating as Myxa VPN, or Муха VPN. The findings includes identical code-generation markers, shared analytics accounts, synchronised domain registrations, common hosting infrastructure, a 12-digit taxpayer number, and leaked Windows build paths referencing a myxa-work project directory, reflecting common operational control.
221 of the 737 extensions by the time of research, with 516 still listed representing 58,318 installs.
Several steps for affected users and administrators includde:
- Verify proxy settings – chrome://net-internals/#proxy displays the browser’s active proxy configuration. An entry the user did not set indicates an extension configured it.
- Rotate credentials entered over HTTP while an affected extension was active.
- Install from vendor links – Real VPN providers link to their own store listings from their websites.
- Enterprise allowlisting – Chrome’s `ExtensionInstallAllowlist` policy restricts installation to approved extension IDs.
Leave a Reply