Executive Summary
A large-scale campaign involving at least 737 Chrome VPN extensions has been identified targeting Russian-speaking users. The extensions impersonate 66 legitimate privacy brands, including NordVPN, Proton VPN, and AmneziaVPN, to lure users seeking access to blocked services. Once installed, these extensions force all browser traffic through a SOCKS5 proxy infrastructure operated by a provider known as Myxa VPN (or Муха VPN), creating an adversary-in-the-middle (AiTM) position.
Technically, the actor utilizes sophisticated evasion techniques including DNS-over-HTTPS (DoH) to resolve proxy IP addresses, preventing plaintext DNS detection, and implementing post-approval code updates to introduce remote configuration layers. Despite some enforcement actions by Google, hundreds of structurally identical extensions remain active due to the actor's use of multiple developer accounts and automated build pipelines.
The campaign's business model appears to be a customer acquisition funnel for a paid subscription service. However, the paid tier often advertises server locations that do not resolve, and the actor's history includes commitments to disclose data to Russian state authorities, presenting a significant privacy and security risk to users relying on these tools for anonymity.