Fake Chrome VPN extensions route traffic through SOCKS5 proxies
Source headline: Hundreds of fake Chrome VPN extensions route traffic through a proxy
Intelligence Summary
Hundreds of fake VPN and proxy browser extensions were published on the Chrome Web Store. The extensions impersonated well-known VPN and proxy services. They routed users' traffic through SOCKS5 proxies operated by a single provider. The report notes that more than 737 extensions were involved. This matters because installing these extensions could expose browsing traffic to an untrusted proxy. Uninstall suspicious extensions and review Chrome Web Store extensions for impersonation before installing.
Recommended Action
Confirm whether the affected technology is in use in your environment before deciding on remediation. Until then, watch authentication and outbound traffic logs for the indicators described in the source. This signal rests on a single report, so corroborate it before acting on anything irreversible.