Exclusive: Hundreds of shady Chrome VPN extensions target Russians including fakes of Windscribe and ExpressVPN

Date:
Thu, 22 Oct 2026 13:53:27 +0000

Description:
Shady VPNs are giving people a false sense of security. But why are Russians being targeted?

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter An exclusive TechRadar investigation into Googles Chrome Web Store has revealed more than 350 untrustworthy VPN extensions targeting Russian users, with many imitating well-known brands. Combined, these tools have amassed over 218,000 users.

Its not the first time potentially dangerous VPN extensions have been discovered. Earlier this year, Palo Alto revealed a significant number of dangerous VPN extensions that could leak users internet traffic. Alarmingly, we discovered that 89 of those extensions are still active and available. So, why are there so many shady VPN extensions specifically targeting Russians, and what are the risks of using these low-quality products? A game of whack-a-mole In total, we discovered that there are 369 Russian VPN
extensions available on Googles Chrome Web Store that fail basic transparency and professionalism tests.

Almost every single extension we analyzed lists a throwaway, anonymous personal Gmail address rather than a professional developer contact. And it appears these operators are running large clusters of extensions just 70 developers are responsible for all of the extensions we found, with one email address associated with 24 individual apps. You may like Hundreds of fake Chrome VPN extensions caught hijacking your traffic Thousands of iOS and Android VPNs are hiding behind fake websites and useless privacy policies here's how to spot them 10 million downloads but no website? New TechRadar data reveals how Android VPNs are gaming the system to avoid supporting users effectively

Nearly three-quarters of these VPNs host their privacy policies on Telegrams anonymous Telegra.ph platform, which hides the true owner of the service, and almost half (47%) have more reviews than users, which may indicate review manipulation.

Perhaps most egregiously, we found over 120 extensions using a name
associated with a legitimate brand.

The most frequently hijacked name was Happ a custom proxy client widely used in Russia which was co-opted by more than 15 extensions. Among major international commercial providers, we found seven extensions imitating Windscribe and five impersonating ExpressVPN.

Both companies told TechRadar that they are aware of copycat extensions appearing on the Chrome Web Store and said they frequently ask Google to remove them when they are found.

Cherlynn Cha, Head of Security Operations at ExpressVPN, said that copycat extensions put people at risk because they give people a false sense of security. The company added that it employs an "enforcement partner to scour the web for unauthorized use of the companys name. What to read next Apple
and Google are hosting hundreds of dangerous VPN links here is why your device is at risk I just got hacked What Play Store reviews reveal about people's VPN expectations Millions of VPN users in the US are inadvertently putting their privacy at risk, Proton warns

However, enforcement can be challenging. Rebecca Rosenberg, Head of Growth at Windscribe, said: Its pretty much a game of whack-a-mole now, the copycat is pulled and two more pop up.

And the data backs that up. One email address we uncovered is linked to 14 apps, with the precise number constantly changing as their extensions are removed and new ones take their place. Why are unprofessional VPN extensions
a threat? Unlike many other extensions, VPNs have the potential to access a huge amount of sensitive data. In fact, a VPN extension asks for more access than almost anything else in the store, Rosenberg said.

A VPN works by encrypting and re-routing your internet connection through one of its servers. While a legitimate VPN improves your digital privacy, it also means you are transferring all your trust from your internet service provider directly to the VPN creator.

In theory, the anonymous developer could see everything your ISP normally monitors. Think: websites visited, time stamps, and your home IP address.

Its a lot of trust to hand over," Cha said. Rosenberg added that giving your data to an anonymous developer with a personal email and a privacy policy
that doesn't load is the opposite of privacy. (Image credit: Future) Ongoing security concerns Without detailed dynamic web testing of all the extensions, its impossible to know which may be harmful to users and which are purely unprofessional. However, Palo Alto previously found more than 350 apps that were linked to harvesting user data via traffic interception.

In our tests, 89 of these extensions were still available to Russian users, while email addresses associated with the extensions have continued to launch more apps since initial discovery.

One email address vale99505@gmail[.]com was first flagged by Palo Alto in July. According to the companys threat intel notice , the address was associated with extensions that do not provide typical encrypted protection like reputed VPN extensions, adding that the threat actor running the apps
has access to all communication.

According to our most recent tests, six extensions linked to this address are still available for download.

At the time of publication, Google had not responded to requests for comment. TechRadar has shared the full list of extensions with the company and will monitor their availability in the coming weeks.

Windscribe said that Google should absolutely be doing more to protect its users from encountering untrustworthy VPN extensions on its Chrome Web Store, while ExpressVPN confirmed the company is in favor of stronger verification for privacy and security tools.

Stopping the rise of untrustworthy VPN extensions is important for everyone. But its no surprise that this specific network is focussed on Russia. Why target Russians? Since the full-scale invasion of Ukraine in 2022,
authorities in Russia have launched an unprecedented crackdown on digital freedom. Thousands of websites have been blocked in the country, including international media, social media and gaming platforms.

In response, VPNs have become a crucial tool for millions of people, which
has subsequently prompted coordinated efforts by the government to regulate and restrict access to these vital privacy and security tools.

Most recently, this has included the plan to use AI to detect and block VPN traffic in the country.

In this context, developers looking to make a quick profit may spin up cheap VPN solutions that are poorly designed, entirely fake, or designed to harvest user data to sell to third-party advertisers.

But theres a darker potential: malicious actors may be intentionally
designing VPN extensions to trick Russians into downloading software that can actively monitor their internet browsing behavior.

While theres no evidence that these extensions are linked to authorities in the country, amid growing concerns about state surveillance and deteriorating internet freedoms, taking extra care when selecting a VPN in Russia today certainly seems sensible. How to defend yourself today There are several
steps you can take to make sure youre downloading a legitimate version of a VPN extension: Check the developers name and website before downloading anything Check that the privacy policy is accessible, informative and related to the app If you know which VPN you want to download, go straight to the providers website Look out for the Established Publisher badge on the Chrome Web Store Check for any unnecessary permissions like geolocation Its worth remembering that a VPN Chrome extension also only protects your activity in your browser. Anything you do outside of the browser wont be encrypted so its worth using a well-respected VPN where possible.

And, like most things, if a product is free, its worth being skeptical. As Cherlynn Cha told us: Be wary of free VPNs. Running a VPN network costs real money. If a service is free and its not clear how it makes money, your data may be whats paying for it. How we found shady Russian VPN extensions We compiled our data using a variety of sources, primarily an in-house web scraping tool that identified VPN extensions on the Google Chrome Web Store targeting Russian-language users. We collected metadata including user
counts, developer contact emails, and privacy policy URLs.

We then filtered the dataset to remove legitimate, verified corporate VPN providers. The remaining extensions were analyzed for untrustworthy signals, such as using personal email addresses, unprofessional privacy policies and copying established VPN brands.

We also cross-referenced our data with threat intelligence research published earlier this year by Palo Alto Networks' Unit 42 to verify how many malicious extensions previously flagged remained active.

All data and user counts are accurate as of October 12, 2026. Extensions are frequently removed and new copycats are constantly appearing. We continue to monitor their accessibility in the coming weeks.



======================================================================
Link to news story: https://www.techradar.com/vpn/vpn-privacy-security/exclusive-hundreds-of-shady -chrome-vpn-extensions-target-russians-including-fakes-of-windscribe-and-expre ssvpn


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)