I often show group to deliberation of VPNs for illustration room funnels. Instead of pouring your web postulation straight into the web and spilling your metadata everywhere, you push it down a constrictive conduit of encryption. You constituent your relationship precisely wherever it needs to spell without leaking each complete the place. Of course, the presumption successful specified an statement is that you trust your VPN, which controls the travel of postulation from your instrumentality to the web. But if the VPN itself is simply a honeypot for attackers to pry distant your data, you’ve conscionable traded respective imaginable information risks for 1 guaranteed information breach.
According to the squad astatine Socket, that’s what’s been happening pinch complete 7 100 clone VPN apps listed connected the Chrome Web Store. Many of these extensions are free, immoderate are paid, and immoderate moreover dress to beryllium from trusted cybersecurity providers to lure users into handing complete unrestricted entree to their web and browser. This weekend, I dug done Socket’s study to find retired precisely what was going connected pinch these apps and really they managed to clear Web Store moderation without getting flagged by Google. I’ll stock what I recovered and connection immoderate tips to thief you debar these clone VPNs.
What Socket recovered erstwhile it analyzed hundreds of suspicious Chrome extensions
In short, Socket’s threat investigation squad analyzed 737 suspicious Chrome extensions that declare to connection VPN and SOCKS5 proxy servers to protect your online privacy. They uncovered paid apps trading entree to VPN servers that do not exist, extensions that hijack your proxy to way online activity, and respective attempts to impersonate trusted VPN work providers for illustration NordVPN and Surfshark.
Socket is simply a cybersecurity level pinch its ain GitHub extension, firewall, and CLI to thief developers analyse AI-written codification for malicious behavior. When they looked into these Chrome extensions, they recovered that they were each published by a full of 40 developer accounts and had racked up 75,486 installs from users connected the Chrome Web Store.
Of the 737 suspicious extensions they analyzed, Socket’s squad performed a elaborate study of the codification successful 525 of them. In total, these extensions amounted to 58,318 progressive Chrome installs astatine the time. As for the different 212, they were already taken disconnected the Web Store earlier Socket could return a look astatine them. But the researchers recovered a number of issues correct distant successful the extensions they did analyze, including:
274 retired of 525 extensions plagiarised the branding and logo of 1 among 66 reputed VPN platforms, including Proton VPN, Surfshark, NordVPN, ExpressVPN, CyberGhost, and TunnelBear.
Two extensions specifically impersonated AmneziaVPN and AntiZapret, which are often utilized to get astir net censorship and surveillance.
Each hold pointed to a fixed SOCKS5 proxy without divided tunneling aliases per-site controls, meaning that each your online activity would get routed done the aforesaid server erstwhile the hold was installed.
104 extensions utilizing documented DNS-over-HTTPS evasion techniques to get astir Chrome’s blocklists by spoofing their DNS record.
Many of these VPNs advertise a paid tier pinch backstage VPN servers successful Japan, Singapore, Canada, Australia, and Turkey. But these servers do not exist, because their hostnames did not resoluteness erstwhile Socket ran a DNS lookup against them.
With the premium VPN subscriptions, location was nary licence verification happening internally to observe if the personification had really paid for a subscription. This is not normal for immoderate web-based app aliases level that offers a paid tier.
One of these extensions, Burёnka VPN, does not way postulation done immoderate servers astatine all. It’s conscionable a clone UI pretending to beryllium a existent app.
Another hold contains a record pinch a plaintext remark that simply reads, “If Chrome Web Store rejects this because of automatically opening links, we tin switch it pinch a notification offering to spell to the Telegram bot.” This shows that the developers cognize that their app violates Web Store policy, but intend to evade reviews alternatively of fixing the issue.
How clone VPNs sewage past Chrome’s reappraisal process
I’ve many times recovered that the champion laid cyber attacks aren’t needfully the astir sophisticated.
Just so, nary of these extensions are peculiarly difficult to emblem successful a thorough codification review. They sewage past Chrome’s defenses because they spent a batch of clip studying Web Store reappraisal processes, perchance learning to evade rejections done repeated proceedings and error. Many of these developers person already had their different extensions removed by Chrome pursuing a akin study from Palo Alto Networks successful June, but they instantly went connected to people caller extensions utilizing the aforesaid playbook.
Even connected the juncture that a developer’s relationship gets pulled from the store, opening a caller developer relationship connected the Chrome Web Store costs $5. Between the 40 developer accounts mentioned successful the report, it hardly costs $200 to people complete 700 clone extensions that reached an assemblage of tens of thousands.
It besides helped that astir of these VPNs were angled toward Russian citizens trying to bypass location censorship regulations, truthful immoderate resulting incidents would not person been wide reported extracurricular that circumstantial target demographic. Perhaps moreover much unsettlingly, successful the fewer occasions that shop moderators did emblem an hold for further review, they each shared precisely identical “privacy justifications” that were small much than mendacious reassurances to get their extensions backmost up.
It’s easy to disregard these clone VPNs arsenic a location threat aimed astatine Russian net users only, but you’d beryllium wrong. Chrome’s Web Store policies overgarment a troubling shape of lax information reviews, and the aforesaid clone VPN playbook could beryllium adapted to target citizens successful the U.S., UK, EU, aliases anyplace other successful the world. In fact, Google itself issued a captious warning successful 2025, speaking of akin clone VPN activity connected the Play Store for Android users.
How to spot a clone VPN browser extension
Since you can’t trust connected app shop reappraisal processes alone, you request immoderate measurement to spot clone extensions earlier they embed spyware into your browser. You can’t beryllium expected to reverse technologist each extension’s manifest files for illustration Socket did, but thankfully, you don’t person to because location are easier ways to show if thing mightiness beryllium amiss.
Install extensions by pursuing a nexus straight from the VPN provider’s charismatic website, not the hunt barroom connected Web Store aliases Google Play.
Always publication reviews earlier installing a caller browser extension. If excessively galore group are complaining astir information concerns, debar it.
Before you instal a Chrome Web Store extension, look past the app listing and personification reviews to the developer relationship tied to that app arsenic well. Check if the relationship is officially associated pinch the VPN supplier and spot if Web Store reviews emblem information concerns connected their different apps too.
Use a instrumentality for illustration WhatIsMyIPAddress.com to cheque your presently visible IP address. Confirm that it matches the IP reside displayed successful your VPN extension’s UI.
Run a DNS leak check while your VPN is connected to make judge that it’s moving properly, not simply concealing your IP reside but besides encrypting your DNS queries. If either your IP address, wide location, aliases net work supplier (ISP) shows up successful the trial results, that’s a reddish flag.
English (US) · 
Indonesian (ID) · 
