369 Questionable Chrome VPN Extensions Target Russian Users: Risks for Chrome and Edge

The 369 figure comes from transparency and professionalism screening. It is not a count of confirmed malware.

What TechRadar reported​

TechRadar's investigation of the Chrome Web Store found more than 350 untrustworthy VPN extensions aimed at Russian users, many imitating well-known brands. Together they have more than 218,000 users. The exact count is 369 Russian VPN extensions that fail basic transparency and professionalism tests. The publication says its data and user counts were accurate as of October 12, 2026. It warns that listings are removed and replaced all the time.

The warning signs it describes:

• Throwaway contacts. Almost every extension lists an anonymous personal Gmail address instead of a professional developer contact.
• Clustering. Just 70 developers are responsible for all the extensions found, and one email address is tied to 24 apps.
• Anonymous privacy policies. Nearly three-quarters host their privacy policies on Telegram's anonymous Telegra.ph platform. 47% have more reviews than users, which may indicate review manipulation.
• Borrowed names. More than 120 extensions use a name tied to a legitimate brand. The most common is Happ, a custom proxy client widely used in Russia, which more than 15 extensions used. TechRadar also counted seven Windscribe imitations and five ExpressVPN imitations.

Windscribe and ExpressVPN both told TechRadar they know about copycats and regularly ask Google to remove them. Windscribe's Rebecca Rosenberg called it "a game of whack-a-mole." ExpressVPN's Cherlynn Cha said copycats give people a "false sense of security." Google had not responded when TechRadar published. TechRadar says it has shared the full list with Google and will keep monitoring availability.

What the investigation does not prove​

TechRadar says plainly that without detailed dynamic testing of every extension, it can't tell which are harmful and which are merely unprofessional. So these are some things you shouldn't conclude:

• That all 369 extensions are malware.
• That all 218,000 users had their data exposed.
• That a personal Gmail address or a Telegra.ph privacy policy proves wrongdoing. Both are reasons to look closer, not proof.

TechRadar also says it found no evidence linking these extensions to Russian authorities.

The link to earlier Palo Alto research​

TechRadar cross-referenced its list against earlier research from Palo Alto Networks' Unit 42. Palo Alto earlier this year revealed dangerous VPN extensions that could leak users' traffic, and TechRadar says 89 of those extensions are still active and available.

Unit 42's July 21, 2026 update describes a different, specific campaign. Other researchers have separately described Russian-language "VPN for X" extensions that quietly steer browser traffic through remotely controlled proxy infrastructure. Unit 42 said it first reported the operation on May 22, 2026. That operation used dozens of fake VPN Chrome extensions routing all browsing traffic through the same 15 hardcoded SOCKS5 proxy servers. By July it had detected over 350 new extensions and at least 32 new Chrome Web Store accounts. It said brand impersonation targets had grown from 4 to 15. It also said only 14 extensions from that campaign had been removed, while more than 3,000 installations were observed.

Unit 42's assessment of that campaign is that the extensions don't give the typical encrypted protection of reputable VPN extensions. It says everything goes through SOCKS5 proxies and that the operator has access to all communications.

TechRadar notes one email address, vale99505@gmail[.]com, that Palo Alto flagged in July. TechRadar says six extensions linked to it were still downloadable in its latest tests. Unit 42's July note linked the same address to 12 extensions. The two counts come from different dates and may use different criteria, so don't treat them as one inventory.

The Unit 42 findings describe that campaign only. They don't show that every extension in TechRadar's separate dataset behaves the same way.

Part of a longer pattern​

Other researchers have reported similar activity this year. Socket's research, as relayed by The Hacker News, described 737 free VPN and proxy extensions that mostly targeted Russian-speaking users. They were published across at least 40 developer accounts and racked up 75,486 installs. Socket found that 274 of them impersonated 66 established VPN and privacy brands, including ExpressVPN and Windscribe.

Socket's findings are a different dataset from TechRadar's, so the numbers shouldn't be added together. They do show that the same kind of abuse keeps resurfacing. One reported detail is that opening a new developer account costs only $5, so 40 accounts could be created for under $200. That helps explain why takedowns feel like whack-a-mole.

Why a fake VPN extension is a real risk​

A VPN extension needs broad control over browser traffic, so it holds a lot of trust. If a fake one routes traffic through a proxy its operator controls, that operator may see which sites you visit, when, and your IP address. How much of the content they can read depends on encryption. HTTPS pages limit what a proxy sees, so don't assume an operator reads everything. Plain HTTP traffic is far more exposed.

Socket's technical description, as summarized by Red Secure Tech, says the extensions set a fixed SOCKS5 proxy through Chrome's proxy settings. The attacker could then see browser destinations, source IP addresses, TLS SNI values and any request body sent over plain HTTP.

There is also a coverage gap. As TechRadar points out, a browser VPN extension only handles browser activity. Other applications on your PC aren't covered. A genuine VPN extension is not a device-wide VPN, and a fake one is worse than nothing because it creates false confidence.

Why Russia​

TechRadar ties the targeting to demand. Thousands of sites are blocked in Russia, and VPNs have become essential for millions of people. The government has also moved to restrict VPNs, including a plan to use AI to detect and block VPN traffic. That gives low-effort or malicious operators an audience that is desperate for tools. Motives could range from quick profit and selling data to advertisers, to deliberate surveillance. TechRadar presents the more sinister possibility as potential, not demonstrated.

What to do about it​

For individuals, based on TechRadar's guidance:

1. Check the developer name and website before installing.
2. Open the privacy policy. It should load, say something meaningful and relate to the product.
3. Go to the provider's own website first and follow its link to the extension instead of searching the store.
4. Look for the "Established Publisher" badge. It's one signal among several, not a guarantee.
5. Review permissions. Be wary of requests that don't fit a VPN's job, such as geolocation.
6. Be skeptical of free VPNs that don't explain how they pay for themselves. Cherlynn Cha's warning was that if you can't see how a free service makes money, your data may be the payment.

For IT administrators, the practical lessons are:

• Audit the extensions installed across managed Chrome and Edge browsers.
• Review each one's publisher identity, permissions and privacy disclosures, and ask whether it is needed at all.
• Consider restricting extension installation to an approved list. This is general industry practice, not something the investigation prescribes.
• Treat the reported names, email associations and counts as investigative leads. The snapshot is dated October 12, 2026 and listings change quickly, so it isn't a current blocklist.

Bottom line​

The central finding is that availability in an official store and familiar branding don't prove an extension is trustworthy. The evidence is a screening dataset plus Palo Alto and Socket research on related campaigns. It does not show that every flagged extension is malicious. It does show that Chrome Web Store enforcement is struggling to keep up. Windscribe said Google "should absolutely be doing more." ExpressVPN backs "stronger verification for privacy and security tools."