A large-scale campaign involved more than 737 fake Chrome VPN extensions published on the Chrome Web Store. These extensions impersonated well-known VPN and proxy services but instead routed users' internet traffic through SOCKS5 proxies operated by a single provider. This behavior could allow the proxy operator to monitor, intercept, or manipulate user traffic. The campaign exploited the trust users place in legitimate VPN services by masquerading as them, potentially exposing users to privacy risks and data interception.

Users who installed these fake VPN extensions had their traffic routed through a proxy controlled by an unknown third party, which could lead to interception, monitoring, or manipulation of their internet activity. This compromises user privacy and security, especially for users relying on VPNs for anonymity or secure communications. There is no indication that these extensions were exploited beyond traffic routing, but the risk of data exposure is significant.

Users should immediately uninstall any suspicious or unverified VPN or proxy extensions from the Chrome Web Store. It is recommended to only install VPN extensions from trusted and verified developers. Google should review and remove these malicious extensions from the Chrome Web Store to prevent further installations. No official patch or fix applies as this is a case of malicious extensions rather than a software vulnerability.