737 Chrome Extensions Were Caught Hijacking Traffic. Here's How to Check Yours

Michael Miller · 2026-08-12

You probably don't think twice before adding a free VPN extension to Chrome. It's a quick fix for geo-restricted content, a tiny privacy boost, or just a way to make that one website stop nagging you about your location. But a recent discovery should make you pause before you hit that blue "Add to Chrome" button again. Security researchers uncovered a massive network of 737 free VPN and proxy extensions, all designed to do something far more sinister than what they promised. Instead of just hiding your IP address, these extensions were quietly intercepting your browser traffic and rerouting it through proxy servers controlled by the people behind them. That means every site you visited, every login you typed, and every bit of data you sent could have been passing through someone else's hands. These extensions weren't targeting everyone, though. They were primarily aimed at Russian-speaking users looking to bypass government blocks and access restricted services. That's a vulnerable audience, people who already feel watched and are seeking a way to break free. And that's exactly what made them such an easy target. ### The Numbers Behind the Threat Let's break down the scale of this operation, because the numbers are staggering: - **737 malicious extensions** were found in total. - They were published across **at least 40 different developer accounts** on the Chrome Web Store. - Combined, they racked up **75,486 installs** before being discovered. - Of those extensions, **274 were found to be impersonating 66 legitimate brands** or well-known tools. The impersonation angle is the sneakiest part. These weren't random, obscure add-ons with weird names. They were dressed up to look like trusted VPNs and proxy tools that people already use. If you saw an extension named after a popular service, you'd assume it was safe, right? That's exactly the assumption these attackers were banking on. ### Why This Matters Beyond the Russian-Speaking Community You might be thinking, "I'm not in Russia, so I'm safe." But that's a dangerous way to look at it. The infrastructure and tactics used here are almost identical to what we see in campaigns targeting English-speaking users in the United States and Europe. The only difference is the audience and the specific blocked services they were trying to reach. The same playbook could easily be repurposed tomorrow to target American users looking for cheaper streaming deals, access to international content, or just a way to appear in a different city for work. The proxy infrastructure is already in place. The code is already written. All they'd have to do is change the language and the list of blocked sites. ### How to Check If You Have One Installed Here's the good news: you can check your own browser in under a minute. Follow these steps to see if you're running any of these compromised extensions: 1. Open Chrome and click the three-dot menu in the top-right corner. 2. Go to **Extensions** > **Manage Extensions**. 3. Look through the entire list. Pay close attention to any VPN or proxy tools you don't remember installing. 4. Check the developer name. If it's a random string of letters or a name you don't recognize, that's a red flag. 5. Review the permissions. A VPN extension shouldn't need access to your browsing history on every single site. If it asks for "Read and change all your data on all websites," that's a major warning sign. If you find anything suspicious, remove it immediately. Then, go to your Chrome settings and clear your browsing data, cookies, and cached files. You might also want to change your passwords for any sensitive accounts, especially if you used them while the extension was active. > "The most dangerous tools are the ones that look exactly like the ones you already trust." — That's the core lesson here. ### Moving Forward with Better Habits The best way to protect yourself isn't just checking for this specific set of extensions. It's building better habits around what you install in the first place. Stick to well-known VPN providers with a proven track record, and download them directly from their official websites rather than the Chrome Web Store. Always read the permissions before installing anything. And regularly audit your extensions, just like you'd clean out your closet or your phone's app list. This incident is a reminder that free tools often come with hidden costs. When a service isn't charging you money, it's usually charging you in data, privacy, or worse. Stay curious, stay skeptical, and keep your browser clean. Your data is worth more than a free proxy.