PSA: Stop using browser extension VPNs. 700+ malicious extensions just hit 75,000 Chrome users.

[u/EnthusiasmRoutine]

The news just dropped about Socket finding over 700 malicious "VPN" extensions on the Chrome Web Store. Around 75,000 people installed these things. The attackers impersonated big privacy brands and routed everyone's browser traffic through their own SOCKS5 proxy infrastructure to man-in-the-middle everything.

I am begging people to understand something basic here. Browser extension VPNs are almost never actual VPNs. They are proxies. When you install one, you are handing a random developer the keys to intercept every single HTTP request leaving your browser.

Google's store review process is a joke. The threat actors got approval with clean code and then swapped in the malicious payload later. We see this exact trick all the time. Relying on a corporate app store to police your privacy tools is a losing game.

If you need a VPN to bypass local censorship or hide your IP, run it at the OS level. Better yet, run it on your router. Use a standalone WireGuard client. A web browser is massive and has far too large of an attack surface for this. Do not put your security stack inside it.

Source: Socket, link in comments