Socket finds 737 free VPN Chrome extensions routing user traffic through proxies

Researchers at Socket identified a campaign of 737 free virtual private network and proxy extensions published across browser marketplaces that route users' web traffic through outside proxy servers. Many impersonate well-known brands to appear trustworthy, so a user installing what looks like a legitimate free VPN can instead have their browsing redirected through infrastructure they do not control. Because a browser extension can see and alter the pages a user visits, routing traffic this way exposes browsing activity and can enable interception. Free VPN and proxy extensions are a recurring source of this problem, trading the promise of privacy for the opposite.

Check

Review the browser extensions installed across your users for free VPN or proxy tools, remove untrusted ones, and prefer reputable, audited services over free extensions that route traffic through unknown servers.

Affected

Users who installed free VPN or proxy browser extensions, including brand-impersonating ones; their web traffic can be routed through servers the operator controls, exposing browsing activity and enabling interception.

Fix

Restrict which browser extensions users can install through policy, allowlist trusted publishers, audit installed extensions periodically, and educate users that free VPN extensions often monetize by handling their traffic.