A cluster of 31 Russian-language Chrome extensions masquerading as VPN services for blocked platforms like RuTracker, YouTube, Telegram, Instagram, ChatGPT, and Netflix shares a single malicious codebase. Published from three linked Google accounts, these extensions collectively affect approximately 356,000 users, with the flagship RuTracker VPN extension holding 200,000 installations. The extensions request extensive proxy permissions and dynamically fetch proxy server configurations from remote sources including GitHub Pages, Blogspot, Google Docs, and Telegram channels after installation. This architecture allows operators to modify traffic routing without pushing updates. The configuration uses obfuscated server lists with shared credentials and offers a paid VIP tier for 299 roubles. Some proxy hostnames match those used by Browsec VPN premium servers, suggesting a potential operational connection.

Indicators of Compromise

• domain: api.hhos.ru
• domain: de34.rapidstaticserve.cc
• hash: 0fa1d38b9dd7e089db3b47407cb684475e184cd6e0683ec252fe3218f169599c
• hash: 2052a339947490fb10296e6e1f9857a83705a3716a528ed22c65e098b1a593e1
• hash: 29ecbcd44d9e1121c2ba2edad26c214036ab83eeb41f7758e4252ae8f92e3393
• hash: 2a5a967d232d97ff3a4983eefeac69347eaf88d19efdd1e783b2d0268226e894
• hash: 2ebeb17cdbeab7547c8dfebade198739e0f1c5dbf9de2977ce318bfcf132d318
• hash: 3477d7c15ed67ba56295a2a64e525ce3ced65be292b873d154ad2e88de340ae6
• hash: 3d5474b8c852791b8342c32db431d34a7564c6ceafd7262f91b0fd65f31ddd3b
• hash: 42214acf020e9d2b394da8f5b3ece7c25b09d240efa4bbb17a7259495b50c102
• hash: 5056c305bdb4bd4dee82892d7b96230e32e61dc3b3ebd045d46fd0c73c0d75a2
• hash: 57436513f2eb13cb0565b9a2851c7013c3ee27a8153e57612259a7a273fc3335
• hash: 5a02f7f8498d2fc90fa19cf9f0d93fdad0ef7fb78b04fbf712039e22c06dba29
• hash: 6a36994ea46e789cef5aed702b48e91762dff32c2e5d880db45801d61463a4ce
• hash: 6d132a550a7744feeccd21615f1c1abb7d14daa32f900102321df58165d2e110
• hash: 76fa58449b15814cfdf4e10120f6edaaa00660e4cc992def2634b7d4d8443af4
• hash: 7d5379a257d36469b963a321603db868c3634b64c6124c51a35b17f1c7e32db5
• hash: 7f83fae6783ecc6007953802685917c9a596a3d2f38dadc17c294124db6381ae
• hash: 84429d31af29467f86c96229fcb85c4beb9efb7280140a9570f9cab0cb0621e0
• hash: 8757fa3c656595aa741fc79af964ae1442f3adf9d9a5bc93a66ffb2c7001a12f
• hash: 8a509c926d2a1e3bba524c1aeb87058a08a2e52c3048e01ef1ac8a6fae07ce4e
• hash: 8bc7faf26555af80d943808be5ed89599ae19df6f78ef38a7c62dc2cf717baf4
• hash: a0c8e8c03f1b11b84e24e3bd12e7002f1eea1cba855b8f318912c4e08e63a611
• hash: aee7413034beccb36ce9b13eb8bebb3c008b4e2f6a092ec1a74c571c2b9ec0dd
• hash: bc3c0c58b7e16de0393818fed42b8e476fc61120fd487e60b12a0f608dfa16e6
• hash: d8a42924fe433f50babe00be88e434e53960244b6b3a52090863f803b08b0190
• hash: dd603f364f0ba58316fa103db4bfc6a03556d00f8a972a6d22fd046991df3964
• hash: e72c9abb39a7be23230d6dcdaa13c89e0606783f4ede14acef48e610159bf80e
• hash: f5fef1fdb44b78653d6826a16fcb886b080f95b21f94474979ef7283c2e5376e
• hash: f9d72431b6bf14fded482e1137bdecaed3107e7a82ab740bdd3959bcf3884a4c
• domain: mainapi.store