GoKawiilMore than 737 browser extensions published on the Chrome Web Store impersonated well-known VPN and proxy services while routing users’ traffic through SOCKS5 proxies operated by a single provider.
Some of the extensions impersonated dozens of established brands, including Proton VPN, NordVPN, Surfshark, ExpressVPN, and Cloudflare’s 1.1.1.1 public domain name system (DNS) resolver.
Researchers at application security company Socket found that the campaign relied on 40 publisher accounts and used a shared analytics account.
While on the Chrome Web Store, the extensions were downloaded nearly 75,000 times, mainly by Russian users looking for tools to bypass blocked services in the country.
“With all browser traffic forced through it [the relay], the threat actor’s server is positioned to read every destination, every TLS SNI value, the victim’s source IP, and any request body sent over plain HTTP,” Socket explains.
The researchers identified three threat behaviors associated with the campaign:
520 extensions configured Chrome to route all browser traffic through the operator’s SOCKS5 proxies on port 1082.
104 extensions resolved their proxy hostnames through Cloudflare or Google DNS-over-HTTPS to protect the operator’s domain from scrutiny.
Extensions that advertised non-existent premium servers in Japan, Singapore, Canada, Australia, and Turkey for subscription fraud
Socket could not analyze the code in all of the extensions because 212 of them had already been removed when the researchers collected them.
... continue reading