The "VPN for X" Proxy Farm — Risky Plugins

A cluster of 31 Russian-language Chrome extensions masquerading as VPN services for blocked platforms like RuTracker, YouTube, Telegram, Instagram, ChatGPT, and Netflix shares a single malicious codebase. Published from three linked Google accounts, these extensions collectively affect approximately 356,000 users, with the flagship RuTracker VPN extension holding 200,000 installations. The extensions request extensive proxy permissions and dynamically fetch proxy server configurations from remote sources including GitHub Pages, Blogspot, Google Docs, and Telegram channels after installation. This architecture allows operators to modify traffic routing without pushing updates. The configuration uses obfuscated server lists with shared credentials and offers a paid VIP tier for 299 roubles. Some proxy hostnames match those used by Browsec VPN premium servers, suggesting a potential operational connection.

• Data-stealing Chrome extensions impersonate Fortinet, YouTube, VPNsCampaign2025-05-22
• Malicious Chrome and Firefox Extensions Steal Crypto Traders' Session and Wallet DataMalware2026-09-10
• 737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic RedirectionCampaign2026-08-12
• Chrome and Firefox Extensions Posing as Free VPNs Add Clipboard Stealers via Malicious UpdatesMalware2026-06-30
• How 23 Browser Extensions Silently Monetize ~758,000 Users' SearchesCampaign2026-06-15