Cybersecurity firm Socket has identified over 700 fake VPN extensions on the Chrome Web Store. Many of these steal user data or impersonate well-known providers.

Socket's threat research team analyzed 737 suspicious extensions that claimed to offer VPN and SOCKS5 proxy services. These were published under 40 developer accounts and had a combined 75,486 installs.

Some of the extensions are paid apps that sell access to VPN servers that do not exist. Others hijack the browser proxy to track user activity or impersonate providers such as NordVPN and Surfshark.

The extensions passed Chrome Web Store moderation by learning how to evade the review process.

Socket's Findings on Fake VPN Extensions and Chrome Web Store Evasion

Socket analyzed the code of 525 out of the 737 extensions, which together had 58,318 active Chrome installs at the time. The remaining 212 extensions had already been removed from the Web Store before the analysis. The researchers found several issues:

• 274 of the 525 extensions plagiarized the branding and logo of one of 66 reputable VPN platforms, including Proton VPN, Surfshark, NordVPN, ExpressVPN, CyberGhost, and TunnelBear.
• Two extensions specifically impersonated AmneziaVPN and AntiZapret, which are often used to bypass censorship and surveillance.
• Each extension used a fixed SOCKS5 proxy without split tunneling or per-site controls. Once installed, all browser activity was routed through the same server.
• 104 extensions used known DNS-over-HTTPS evasion techniques to bypass Chrome's blocklists by spoofing DNS records.
• Many extensions advertised paid tiers with servers in Japan, Singapore, Canada, Australia, and Turkey. These servers did not exist, as their hostnames did not resolve in DNS lookups.
• Premium subscriptions did not include any internal license verification to confirm payment, which is unusual for a paid service.
• One extension, Bur?nka VPN, does not route any traffic through servers. It only displays a fake user interface.
• Another extension included a plaintext code comment admitting it violated Web Store policy and outlining a plan to evade review instead of fixing the problem.

None of these extensions would be hard to flag in a thorough code review. The developers appear to have learned how to bypass Chrome's defenses by studying the review process and using trial and error.

Many of the developers had previous extensions removed by Chrome after a similar report from Palo Alto Networks in June. They quickly published new extensions using the same methods.

Since opening a new Chrome Web Store developer account costs $5, it cost about $200 to use 40 accounts to publish over 700 fake extensions that reached tens of thousands of users.

Most of the VPNs targeted Russian users trying to bypass regional censorship. As a result, incidents were not widely reported outside that group. When moderators did flag an extension, the developers responded with identical privacy justifications that offered little more than false reassurances to get the extensions restored.

This is not solely a regional threat, noting that the same playbook could be adapted to target users in the US, UK, EU, or elsewhere. Google itself issued a warning in 2025 about similar fake VPN activity on the Play Store for Android.

How Users Can Spot Fake VPN Chrome Extensions

Since app store reviews cannot be relied on alone, users can take steps to avoid fake extensions:

1. Install extensions by following a link directly from the VPN provider's official website, not the Web Store search bar.
2. Read user reviews before installing and avoid extensions with frequent complaints about security issues. Developer account tied to the app, confirming it is officially associated with the VPN provider and checking whether their other apps have se
3. Use a tool such as WhatIsMyIPAddress.com to confirm that your visible IP address matches what the extension displays.x
4. Run a DNS leak test while the VPN is active to confirm it encrypts DNS queries. If your real IP, location, or ISP appears, treat it as a red flag

Socket's report covers extensions that were active on the Chrome Web Store at the time of analysis, with 212 already removed before the review. This pattern suggests weak security reviews on the Web Store, and that developers have repeatedly returned with new accounts after removals.

Google has not said whether it will change its review process in response. Users should verify VPN extensions themselves instead of relying on store moderation.

Thank you for being a Ghacks reader. The post Report Finds Over 700 Fake VPN Extensions on the Chrome Web Store With 75,000 Installs appeared first on gHacks.

TikTok will pay $300 million immediately and another $100 million after an order vacates an earlier consent decree against its predecessor company, Musical.ly.

The post TikTok Reaches $400 Million Settlement With US Justice Department Over Children’s Privacy appeared first on SecurityWeek.

The attack caused real-world operational disruption and raised concerns about the resilience of Britain’s distributed energy infrastructure and the potential for repeatable attacks.

The post Iran-Linked Hackers Shut Down UK Power Plant for Four Days appeared first on SecurityWeek.

Researchers at Adversa AI disclosed an attack technique that smuggles malicious instructions past AI safety filters by encrypting them. They then demonstrated it against production deployments of xAI's Grok and Google's Gemini - including a zero-click chain that could exfiltrate a Grok user's entire chat history.

The technique, which the researchers call Cryptographic Context Injection, inverts the usual assumption behind input filtering. Guardrails inspect prompts and retrieved content as text; an AES-256-GCM ciphertext contains no readable instruction to flag. The model itself performs the decryption inside its own code-execution sandbox, and then treats the recovered plaintext as trusted intermediate output rather than as untrusted external content. Adversa noted that every element a scanner would need is present on the page, but recovering it requires "running PBKDF2 and AES-256-GCM."

That distinction separates the work from earlier cipher-based jailbreaks such as CipherChat and CodeChameleon, which relied on substitution ciphers or Base64 encoding that large language models can decode natively during inference. Strong authenticated encryption forces execution, and execution is what launders the payload's provenance.

The demonstrated impact differed by target. Against Grok, the researchers showed an indirect, zero-click path. Encrypted JSON embedded in a web page is picked up when Grok's agentic browsing analyzes the site, and the decrypted instructions then leak session data like user name, coarse location, subscription tier and full conversation history, to an attacker-controlled URL. No click or warning reached the user.

Also read: French Police Raid X Offices as Grok Investigations Grow

Against Gemini 3 Flash on the web at the paid tier, the same approach produced instructions for building incendiary devices in the model's Deep Thinking mode, and caused the model to reproduce its own system instructions. Adversa said its Gemini success rate had fallen sharply since June and dropped significantly by August, but could not attribute the change to filter updates, model version changes or both.

Vendor engagement was limited. Adversa reported the Grok issue to xAI on June 3, received an initial acknowledgment, and followed up on August 4 and 10 without substantive response. The firm confirmed the attack still reproduced on August 19.

The Gemini finding was never formally reported, because Google's AI vulnerability reward program excludes prompt injection, jailbreaks and alignment issues from scope, directing them instead to in-product feedback channels. Guardrail-bypass research at one of the largest model providers therefore sits outside a coordinated-disclosure track with a reward and a disclosure clock.

The findings land against a body of evidence that prompt injection remains the dominant failure mode in deployed agentic systems, a position reflected in OWASP's guidance and in Microsoft research published in May on remote code execution in AI agent frameworks. The pattern here is narrower and more concerning for defenders. Content-based guardrails, the primary control most enterprises have deployed, are structurally unable to inspect a payload that only exists in plaintext after the model has already decided to trust it.

Whether xAI ships a fix or acknowledges the report, whether Google revises its reward-program scope to cover guardrail bypasses, and whether AI security vendors move detection from input text to sandbox execution monitoring, is something to watch-out for.

Apollo Global Management has admitted that attackers talked their way into its cloud systems and got their hands on Social Security numbers and other personal information. The investment giant disclosed the breach in a notification filed with California's attorney general, saying it had suffered a "social engineering incident" that resulted in unauthorized access to "certain cloud platforms" between July 6 and July 10. Apollo isn't saying which cloud platforms were compromised, how the attackers got in, or how many people are affected by the breach. What it does say is that its investigation determined on August 12 that the potentially compromised information included names, dates of birth, contact information, home addresses, and Social Security numbers. The company said it has so far found no evidence that the information has been publicly posted or used for identity theft or fraud. Those affected are being offered 24 months of credit monitoring and identity protection services. "Upon detecting the incident, we promptly notified law enforcement, engaged leading outside cybersecurity and forensic experts, enhanced our security protocols, and launched an investigation," Matthew Breitfelder, Apollo's global head of human capital, said in the notification. The breach comes weeks after Google warned that UNC6671, an extortion-focused crew also known as "BlackFile," was targeting private equity firms and other financial-sector companies. Reuters reported at the time that Apollo was among the companies targeted, alongside Blackstone, Bridgewater and Bain Capital, although it was then unclear whether any of the attacks had succeeded. Apollo's disclosure now confirms that, in its case at least, someone did get in. While the company has not attributed the breach to UNC6671, its notification makes a point of linking the incident to similar attacks elsewhere, saying: "Similar to other financial services firms, Apollo recently experienced a social engineering incident." Google said UNC6671 has been calling employees on their personal phones while posing as colleagues or IT support staff, then steering them to spoofed login pages built to harvest credentials and multi-factor authentication codes. Once inside, the attackers steal corporate data and threaten to publish it unless victims pay up. Some payments have reached $750,000, according to Google's researchers. The incident lands amid a run of attacks in which crooks have gone after employees rather than trying to batter their way through corporate defenses. Earlier this month, Levi Strauss said that social engineers compromised three employees' company-issued computers and made off with corporate data. For Apollo, plenty remains unanswered, including whose Social Security numbers were exposed and exactly how many people now have reason to watch their credit reports more closely. ®

In mid-2026, hundreds of thousands of user records allegedly sourced from Golf Canada began circulating via Telegram. The data included 569k unique email addresses along with names, usernames, dates of birth, genders and approximate geographic locations (city, province and postcode). Golf Canada didn't respond to multiple attempts to make contact, and it remains unclear whether the data was obtained via unintentionally exposed website features or a security vulnerability.