Numerous Fake VPN Services Have Appeared in the Chrome Web Store.

I often advise people to think of VPNs as hoppers. Instead of sending network traffic directly to the internet and scattering metadata everywhere, you route it through a narrow, encrypted pipe. You route the connection exactly where it needs to go, without leaking any data. Of course, this assumes you trust your VPN, which controls the flow of traffic from your device to the internet. But if the VPN itself is a honeypot for attackers seeking to steal your data, you trade several potential security threats for one guaranteed security breach.

According to the Socket team, this is exactly what’s happening with over 700 fake VPN apps hosted in the Chrome Web Store. Many of these extensions are free, some are paid, and some even pose as apps from reputable cybersecurity providers to lure users into granting unrestricted access to their network and browser. This weekend, I examined Socket’s report to find out exactly what’s going on with these apps and how they manage to pass Web Store moderation without being flagged by Google. I’ll share my findings and offer some tips to help you avoid these fake VPN apps.

What did Socket find after analyzing hundreds of suspicious Chrome extensions?

In short, the threat research team Socket analyzed 737 suspicious Chrome extensions claiming to offer VPNs and SOCKS5 proxy servers to protect your online privacy. They discovered paid apps selling access to non-existent VPN servers, extensions that intercept your proxy to track your online activity, and several attempts to impersonate reputable VPN providers such as NordVPN and Surfshark.

Socket is a cybersecurity platform with its own GitHub extension, firewall, and command-line interface, helping developers analyze AI-powered code for malicious behavior. A study of these Chrome extensions revealed that they were published by a total of 40 developer accounts and had accumulated 75,486 user installs in the Chrome Web Store.

Of the 737 suspicious extensions they analyzed, the Socket team conducted a detailed code analysis of 525 of them. At the time, these extensions had a total of 58,318 active installations in Chrome. The remaining 212 had already been removed from the Web Store before Socket could check them. However, the researchers immediately discovered a number of issues in the analyzed extensions, including:

• Of the 525 extensions, 274 copied the branding and logo of one of 66 well-known VPN platforms, including Proton VPN, Surfshark, NordVPN, ExpressVPN, CyberGhost, and TunnelBear.

• Two extensions specifically mimicked AmneziaVPN and AntiZapret, which are often used to bypass internet censorship and surveillance.

• Each extension pointed to a fixed SOCKS5 proxy with no split tunneling or site-level control, meaning that all your online activity after installing the extension would be routed through the same server.

• 104 extensions use documented DNS-over-HTTPS bypass techniques to bypass Chrome’s block lists by spoofing their DNS record.

• Many of these VPN services advertise paid plans with private VPN servers in Japan, Singapore, Canada, Australia, and Turkey. However, these servers don’t exist because their hostnames weren’t resolved when performing a DNS query using Socket.

• In the case of paid VPN subscriptions, there was no internal license check to determine whether the user had actually paid for the subscription. This is not the norm for any web application or platform offering paid plans.

• One such extension, Burёnka VPN, doesn’t route traffic through any servers at all. It’s simply a fake user interface that mimics the real app.

• Another extension contains a file with a text comment that reads, “If the Chrome Web Store rejects this app for automatically opening links, we may replace it with a notification directing you to a Telegram bot.” This indicates that the developers are aware of the violation of Web Store policies but intend to avoid review rather than fix the issue.

How Fake VPNs Bypass Chrome Security

I have learned time and time again that the most sophisticated cyberattacks are not necessarily the most complex.

However, none of these extensions are particularly difficult to detect with a thorough code review. They bypassed Chrome’s protections because the developers spent considerable time learning the Web Store review processes, perhaps learning to avoid rejections through trial and error. Many of these developers had already had their other extensions removed by Chrome after a similar notice from Palo Alto Networks in June, but they immediately released new extensions using the same tactics.

Even if a developer account is removed from the store, creating a new developer account in the Chrome Web Store costs $5. Based on the 40 developer accounts mentioned in the report, publishing over 700 fake extensions, reaching tens of thousands of people, cost just $200.

It also played a role that most of these VPN services were aimed at Russian citizens seeking to circumvent regional censorship rules, so any incidents that arose would not have received widespread coverage outside this specific target group. Perhaps even more alarming is that in the few cases where store moderators flagged extensions for further review, they all cited identical “privacy excuses” that were nothing more than false assurances to get the extensions back up and running.

It’s easy to dismiss these fake VPN services as a regional threat targeting only Russian internet users, but that’s not the case. The Chrome Web Store’s policies demonstrate a disturbing pattern of lax security checks, and the same fake VPN scheme could be adapted to attack citizens of the US, UK, EU, or any other country. Moreover, Google itself issued a critical warning in 2025 , noting similar fake VPN activity in the Play Store for Android users.

How to spot a fake VPN browser extension

Since you can’t rely solely on app store verification processes, you need a way to detect fake extensions before they inject spyware into your browser. You’re not expected to be able to reconstruct every extension’s manifest file, as Socket did, but fortunately, you don’t need to, as there are easier ways to detect if something might be amiss.

• Install extensions by following the link directly from the VPN provider’s official website, rather than through the search bar in the Web Store or Google Play.

• Always read reviews before installing a new browser extension. If too many people complain about security issues, it’s best to avoid it.

• Before installing an extension from the Chrome Web Store, pay attention not only to the app description and user reviews, but also to the developer account associated with the app. Check whether this account is officially associated with a VPN provider, and see if Web Store reviews point to security issues in other apps.

• Use a tool like WhatIsMyIPAddress.com to check your current visible IP address. Make sure it matches the IP address displayed in your VPN extension’s user interface.

• Run a DNS leak test while your VPN is enabled to ensure it’s working properly, not only hiding your IP address but also encrypting your DNS requests. If the test results show your IP address, approximate location, or internet service provider (ISP), this is a warning sign.

More…