737 Chrome Extensions Secretly Hijacked Your Browser Traffic. Here's How to Check

Michael Miller · 2026-08-12

You probably don't think twice about installing a free VPN extension. It promises privacy, unlocks a blocked site, and takes two seconds to add. But what if that tiny add-on was quietly doing something far more sinister with your browsing data? Security researchers just uncovered a massive network of 737 free VPN and proxy extensions on the Chrome Web Store. These weren't your run-of-the-mill ad injectors. They were engineered to intercept your browser traffic and reroute it through a proxy infrastructure controlled by the attackers. Here's the kicker: most of these extensions weren't targeting English-speaking users at all. They were specifically designed to lure Russian-speaking users who were looking for ways to access blocked services. But that doesn't mean you're in the clear. If you've ever installed a free VPN, you need to read this. ### The Scale of the Problem This isn't a small operation we're talking about. The 737 extensions were spread across at least 40 different Chrome Web Store developer accounts. That's a deliberate effort to avoid detection. Instead of one suspicious developer dropping hundreds of extensions, they spread the load across dozens of accounts to look more legitimate. All together, these extensions racked up a staggering 75,486 installs. That might not sound like a lot compared to some mainstream apps, but for a targeted campaign, it's significant. Every single one of those installs represents a real person whose browsing habits were potentially exposed. What's even more concerning? Of the extensions identified, 274 were found to be impersonating 66 legitimate browser extensions. So if you thought you were installing a well-known tool, you might have actually grabbed a malicious clone.  ### How the Attack Worked Let's break down how this actually functioned, because understanding the mechanics helps you spot similar threats in the future. - **Luring the target**: The extensions promised access to blocked websites and services, which is a huge draw for users in regions with heavy internet censorship. - **Gaining trust**: Many of them mimicked popular, legitimate extensions to look trustworthy at first glance. - **Intercepting traffic**: Once installed, they didn't just sit there. They actively intercepted your browser traffic and routed it through their own proxy servers. - **Data exposure**: Anything you typed, any site you visited, any login credentials you entered — it all passed through infrastructure controlled by the attackers. This isn't just about serving you extra ads. This is about harvesting your data, potentially capturing passwords, session tokens, and other sensitive information. ### Why Proxy Routing Is Dangerous When you use a VPN or proxy, you're trusting that service with all your traffic. That's the whole point. But when a malicious extension does it, you're handing your data to someone with zero incentive to protect it. Think of it like this: using a legitimate VPN is like mailing a letter in a sealed envelope. Using one of these malicious extensions is like handing your letter to a stranger who promises to deliver it, but opens it, reads it, and copies down every detail before sealing it back up. ### How to Check If You Have One Installed If you're worried you might have one of these extensions, here's how to check right now. Open Chrome and type `chrome://extensions` in the address bar. Look through your entire list. Do you see any VPN or proxy extensions you don't remember installing? Do you see any that look like clones of popular tools but have slightly different names or icons? Pay special attention to extensions that have access to all your browsing data. Chrome shows this permission clearly. If a VPN extension has "Read and change all your data on all websites" permission, that's exactly what it's doing. ### What to Do If You Find One If you spot a suspicious extension, remove it immediately. Don't just disable it — remove it completely. Then, change your passwords for critical accounts, especially email, banking, and social media. Consider running a malware scan on your system, just to be safe. And moving forward, be extremely selective about which extensions you install. Stick to well-known publishers, check the number of installs, and read recent reviews. ### The Bottom Line Free VPN extensions are almost never worth the risk. If you need to bypass regional blocks or protect your privacy, use a reputable, paid VPN service that you've verified. The 75,486 people who installed these malicious extensions learned this lesson the hard way. Don't be the next one. Take two minutes right now to audit your browser extensions. It's a small step that could save you from a massive headache down the road.