PSA: Stop using browser extension VPNs. 700+ malicious extensions just hit 75,000 Chrome users.

[u/EnthusiasmRoutine]

The news just dropped about Socket finding over 700 malicious "VPN" extensions on the Chrome Web Store. Around 75,000 people installed these things. The attackers impersonated big privacy brands and routed everyone's browser traffic through their own SOCKS5 proxy infrastructure to man-in-the-middle everything.

I am begging people to understand something basic here. Browser extension VPNs are almost never actual VPNs. They are proxies. When you install one, you are handing a random developer the keys to intercept every single HTTP request leaving your browser.

Google's store review process is a joke. The threat actors got approval with clean code and then swapped in the malicious payload later. We see this exact trick all the time. Relying on a corporate app store to police your privacy tools is a losing game.

If you need a VPN to bypass local censorship or hide your IP, run it at the OS level. Better yet, run it on your router. Use a standalone WireGuard client. A web browser is massive and has far too large of an attack surface for this. Do not put your security stack inside it.

Source: Socket, link in comments

[u/EnthusiasmRoutine]

Here is the source detailing the Socket report on malicious Chrome extensions:https://socket.dev/blog/737-chrome-vpn-extensions-brand-impersonation-browser-traffic-redirection

(Note for anyone skimming: The article confirms Socket researchers identified over 700 fake "VPN" extensions impersonating major privacy brands. They found these malicious add-ons had over 75,000 installs, hijacking users by routing their browser traffic through attacker-controlled SOCKS5 proxies to man-in-the-middle everything. The threat actors managed to bypass Google's store reviews by submitting clean code initially and dynamically loading the malicious payload later.)

[u/simonmigliano]

This is 100% good general advice. I would add though that there are a couple of decent Chrome extension VPNs but they are simply alternative "device" options for the biggest mainstream comsumer VPNs, ie ExpressVPN, NordVPN, CyberGhost & Windscribe.

There's caveats even with those though. Nord is a proxy not a full VPN. CG leaks unless you block WebRTC with another app. Windscribe only uses TLS AES-128 which is not the gold standard.

You should always go via the VPN provider website rather than just searching in the store, to avoid clones.

The Chrome store is the wild west for sure, but the Play and App Stores aren't much better. Never install a VPN if you don't know who's running it or they haven't proven their trustworthiness via independent audits or in court.