737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection

A large-scale malicious Chrome extension campaign involving 737 extensions has been identified, primarily targeting Russian-speaking users seeking access to blocked services like Instagram and YouTube. These extensions impersonate 66 legitimate VPN brands—including Proton VPN, NordVPN, and AmneziaVPN—and route all browser traffic through attacker-controlled SOCKS5 proxies on port 1082, enabling man-in-the-middle attacks. The campaign uses DNS-over-HTTPS for evasion, falsely advertises premium server locations that do not exist, and employs post-approval code substitution to bypass store review. One threat actor behind the operation runs a subscription-based business under the name 'Myxa VPN', which also sells access to the malicious extensions.

AI-extracted · verify before operational use