737 Impersonating Chrome VPN Extensions Route All Traffic to Shared Russian SOCKS5 Proxies

The extensions, published under 40 developer accounts, impersonate 66 legitimate VPN brands including NordVPN, Proton, and 1.1.1.1. 520 of 522 bulk samples force every non-localhost request through the same proxy while advertising nonexistent premium servers. Code leaks show a 12-digit Russian taxpayer ID and Windows paths referencing "ollob" and "myxa-work." Post-approval remote config layers and identical review statements claiming "no data transmitted" indicate deliberate evasion of store policies. 221 extensions were removed; 516 remain active. The operator runs a paid subscription service in Russia while reselling or controlling the upstream proxies. Every connected session exposes destination, SNI, and HTTP bodies to that single relay. This pattern matches prior Russian proxy reseller operations that rotate domains after takedowns. Chrome's review process lacks persistent code integrity checks, allowing clean-then-poison updates. Users seeking censorship circumvention remain the primary target pool. Expect continued domain and IP rotation plus new brand impersonations within weeks.