737 Malicious Chrome VPN Extensions Hijack Traffic via a Single SOCKS5 Proxy
Security researcher Kush Pandya uncovered 737 free VPN and proxy Chrome extensions across 40+ developer accounts that hijack the entire browser session, routing it through a single SOCKS5 proxy. The extensions impersonate reputable brands, giving the actor full visibility into URLs, IPs and HTTP data, and still have over 500 active installs. Users—especially Russian‑speaking—should uninstall any unknown VPN add‑on.