Mass Chrome VPN Extension Campaign Targeting Russian Users via Proxy Interception
737 malicious Chrome VPN and proxy extensions across 40+ developer accounts, totalling 75,486 installs, were designed to intercept browser traffic and route it through attacker-controlled proxies, primarily targeting Russian-speaking users circumventing content restrictions.
Affected
A coordinated campaign has distributed 737 malicious extensions through at least 40 compromised or attacker-registered Chrome Web Store developer accounts. The extensions were designed to intercept user browser traffic and redirect it through attacker-controlled proxy infrastructure. The targeting of Russian-speaking users seeking access to blocked services indicates the operators understood their audience and positioned the malware as a solution to content filtering rather than as malicious software.
The attack surface here is significant: 75,486 installations means tens of thousands of users had their traffic visibility compromised. The fact that 274 extensions impersonated 66 legitimate services suggests sophisticated social engineering and brand spoofing to lower user suspicion. Users installing what they believed to be VPN or privacy tools instead granted the extension permissions to inspect and modify all network traffic, effectively becoming endpoints for a proxy botnet.
This represents a supply-chain vulnerability in the Chrome extension ecosystem rather than a platform vulnerability. The Web Store's vetting processes failed to detect either the coordinated account creation across dozens of accounts or the malicious functionality common to all 737 extensions. The ease with which multiple developer accounts could be established or compromised, combined with apparent gaps in behavioural detection for extension uploads, reveals systemic weakness in the ecosystem governance.
Defenders should audit Chrome extension installations for any VPN or proxy tools, particularly those from unfamiliar developers or with installation dates aligned with this campaign's activity. Organisations managing Chrome deployments should consider extension allowlisting policies and enforce periodic audits of installed extensions. Users should verify VPN and proxy tools against official vendor websites rather than relying on Chrome Web Store search results alone.
The broader concern is that this attack model is highly scalable and requires minimal technical sophistication once developer accounts are obtained. Similar campaigns likely exist or will emerge targeting other extension ecosystems. The reliance on user-facing extensions for security-sensitive functions like VPN remains a fundamental architectural weakness that no amount of Web Store review can fully mitigate.
Sources