Hundreds of Fake Chrome VPN Extensions Route Traffic Through a Malicious Proxy
What Happened — Researchers identified 737 Chrome Web Store extensions that masqueraded as popular VPN services (e.g., Proton VPN, NordVPN, ExpressVPN). The extensions forced all browser traffic through attacker‑operated SOCKS5 proxies, allowing the operator to read TLS SNI values, source IPs, and any unencrypted HTTP payloads. The campaign attracted roughly 75 000 downloads, primarily from users seeking to bypass Russian censorship.
Why It Matters for Compliance & Audit Readiness
- The scenario exemplifies a loss of access control over client‑side software, a core SOC 2 CC6.1 (Logical Access) requirement.
- Continuous monitoring of third‑party applications and evidence of policy enforcement are essential to demonstrate due diligence in an audit.
- Security‑awareness training that teaches users to verify approved extensions directly supports the “Security Awareness” control (CC7.1).
Who Is Affected — SaaS providers, cloud‑infrastructure firms, and any organization whose employees use Chrome browsers for business tasks; especially high‑risk sectors such as finance, healthcare, and government that rely on VPNs for remote access.
Recommended Actions
- Conduct an inventory of installed browser extensions and cross‑reference against an approved‑software list.
- Enforce a policy that blocks installation of unvetted extensions and logs any proxy‑configuration changes.
- Deploy network‑traffic monitoring to detect anomalous outbound proxy connections.
- Update security‑awareness curricula to include examples of malicious extensions and how to verify publisher authenticity.
Source: BleepingComputer
Technical Notes — The extensions used a shared analytics account and 40 publisher accounts to evade detection. Traffic was routed through SOCKS5 proxies on port 1082; some extensions resolved proxy hostnames via Cloudflare or Google DoH to hide the operator’s domain. No direct data breach was reported, but the proxy position enables full visibility of browsing activity and any plaintext data. Source: BleepingComputer