TLDR Tech / InfoSec
737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection
Socket researchers identified a massive campaign of 737 malicious Chrome VPN extensions, operated by a single threat actor branded as Muxa VPN, targeting Russian-speaking users seeking to bypass regional blocks. Once installed, these extensions abuse the chrome.proxy.settings API to silently force all browser traffic through a SOCKS5 relay on port 1082, with many utilizing DNS-over-HTTPS to evade plaintext DNS logging. While Google has removed some extensions, over 500 remain active, prompting defenders to block egress traffic on SOCKS5:1082 and VLESS-REALITY:443 and heavily scrutinize any extension requesting the proxy permission.
Read the full story