737 CHROME VPN EXTENSIONS LINKED TO BRAND IMPERSONATION AND BROWSER TRAFFIC REDIRECTION

Summary from the TLDR InfoSec newsletter

Socket researchers identified a massive campaign of 737 malicious Chrome VPN extensions, operated by a single threat actor branded as Muxa VPN, targeting Russian-speaking users seeking to bypass regional blocks. Once installed, these extensions abuse the ⁠chrome.proxy.settings⁠ API to silently force all browser traffic through a SOCKS5 relay on port 1082, with many utilizing DNS-over-HTTPS to evade plaintext DNS logging. While Google has removed some extensions, over 500 remain active, prompting defenders to block egress traffic on SOCKS5:1082 and VLESS-REALITY:443 and heavily scrutinize any extension requesting the ⁠proxy⁠ permission.