Summary
Socket's Threat Research Team has uncovered 737 fake VPN and proxy extensions on the Chrome Web Store, impersonating legitimate services like NordVPN and Proton VPN, which have collectively garnered over 75,000 installs. These malicious extensions, linked to a single Russian operator, reroute user traffic without encryption, potentially exposing sensitive data, and many remain active despite Google's actions.