Hundreds of advertised free VPN or proxy tools have been linked to a significant traffic redirection operation This article explores proxy tools linked. . According to a report shared with ZeroOwl (ZeroOwl), they discovered that 274 extensions mimicked or incorporated elements from 66 well-known VPN and privacy services, leading users to believe these tools were legitimate.
Socket.dev’s assessment instead highlights copied brands, premium locations that didn’t resolve, misleading review statements, and features added after initial store approval. Organizations should monitor extensions with access to proxies, watch for changes in proxy settings, and block listed domains and addresses at both DNS and network egress points because encrypted DNS can bypass basic controls.
Chrome extension IDs identified in campaign materials: - aabaifmlfkdolhdbbhjblkeekaijfdfh (part of the campaign) - abjgfdfbmmijjdfbohbhgdnjeipjbplj (also part of the campaign) - kcplchjjdpgehfdlggggoohdeoaikcan - ilpcglpcfdeoehcmjhkfhhgpldgfgjhj - oaidiemgjmaabehcfjfbkeifdpeniemm - containing an internal build manual - marketed as Burёnka VPN - that contained the archived prior build. Domain vpn-myxa[. ]ru, vpnfasters[.
]space, vpnkomar[. ]space, vpnmyha[. ]shop, vpnmyxa[. ]site, zenshield[.
]space, zhuknet[. ]online, zhukvpn[. ]online Proxy and landing infrastructure. The IP addresses listed below are associated with the infrastructure of the network: - 158.160.228.178, 103.35.189.225, 103.35.191.173 - 147.45.60.241, 147.45.60.252, 178.130.47.43, 178.130.47.44, 178.130.47.50, 178.130.47.129 - 185.252.215.97, 185.252.215.98, 194.150.220.163, 45.89.110.227 - 5.180.30.15, 5.180.30.122, 80.92.204.33, 80.92.204.47, 80.92.206.84 - 86.104.74.110, 94.131.118.39, 94.131.118.237, 138.124.244.206, 130.17.1.197 The IP addresses 78.153.155.112, 81.90.31.73, and 95.163.244.138 are associated with SOCKS5 infrastructure.
