Malicious ‘Free’ VPN Extension with 9 Million Installs Hijacks Traffic and Steals Browsing Data

Security researchers at LayerX Security have exposed a sophisticated campaign involving malicious VPN and ad-blocking extensions designed to intercept user traffic and exfiltrate browsing data.

The campaign demonstrates a troubling pattern: even after multiple takedowns, the threat actors behind these extensions continue to relaunch variants with enhanced evasion capabilities.

The current iteration of the campaign boasts 31,000 live installations, but previous incarnations collectively achieved over 9 million installs across the Chrome Web Store.

This persistent threat illustrates the critical vulnerability of browser extensions as an attack surface and the ease with which fraudulent developers can exploit user trust in “free” privacy tools.

Three extensions branded as “Free Unlimited VPN” services remained available in the Chrome Web Store for nearly six years before detection.

The extensions employed professional-looking branding, legitimate-seeming descriptions, and cohesive icon designs to establish credibility. Yet beneath this polished façade lurked invasive surveillance code.

Two of the extensions lingered in the store until May 2025, when they were finally flagged and removed.

Remarkably, only two months later, a nearly identical third extension featuring almost identical descriptions, icon styling, and internal behavior reappeared in the store and remains available at the time of this writing.

Beyond Simple Proxy Masquerading

These weren’t ordinary VPN extensions. Analysis reveals they functioned as remote-controlled proxy redirectors with hidden update channels and concealed capabilities far exceeding typical VPN functionality.

The extensions fetched hidden configuration files from attacker-controlled servers, altered proxy settings in real time. They intercepted browser navigation events to monitor and redirect user traffic.

The technical sophistication of the 2025 variant is particularly alarming. Additionally, the core proxy routing logic, including setup and configuration variables, is downloaded at runtime and executed dynamically.

While removing some overtly suspicious code present in older versions, the new extension incorporates stealthier mechanisms, including delayed proxy activation, dynamic code downloads executed at runtime, and the ability to turn off competing proxy extensions granting attackers near-total control over user browsing with minimal forensic evidence.

If installed, these extensions could intercept and redirect every page users visit, collect comprehensive browsing data and lists of installed extensions, modify or disable other security tools, and route traffic through attacker-controlled servers exposing private activity to surveillance and manipulation.

The malware employs sophisticated evasion techniques including timing gates to evade sandbox detection, history tampering to remove traces of redirects, and server-driven self-uninstall mechanisms to avoid analysis.

By leveraging broad browser permissions such as webRequest, proxy, and declarativeNetRequest, attackers achieved complete visibility and control over user traffic.

Privacy Breach and Active Threats

The extensions collected hashed URLs periodically sent to command-and-control servers for victim profiling, enumerated installed extensions, and intercepted navigation to enable selective phishing page redirects, steered malware download pages, and ad farm redirection all modifiable post-installation without user knowledge.

These extensions represent the evolution of browser-based surveillance from simple credential theft to comprehensive traffic interception and behavioral profiling.

The discovery of six additional nearly identical extensions (disguised as ad blockers and music downloaders) suggests this campaign is far broader than initially apparent.

The repeated cycle of removal and relaunch demonstrates the inadequacy of reactive security measures.

Organizations must implement continuous extension monitoring, analyze behavioral anomalies in real time, and enforce stricter vetting standards for browser extensions.

Users should exercise extreme caution with “free” privacy tools, verify extension developers through official channels, and regularly audit installed extensions for suspicious permissions.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.