TechRadar finds 369 dubious Chrome VPN extensions targeting Russian users

TechRadar said almost every extension it analysed listed a throwaway, anonymous Gmail address instead of a professional developer contact. It found that 70 developers were responsible for all 369 extensions, with one email address linked to 24 apps. Nearly three-quarters hosted privacy policies on Telegram's anonymous Telegra.ph platform, and 47% had more reviews than users, which TechRadar said may indicate review manipulation.

More than 120 extensions used a name associated with a legitimate brand, TechRadar reported. Happ, a custom proxy client widely used in Russia, was the most frequently hijacked name, used by more than 15 extensions. Among international commercial providers, seven extensions imitated Windscribe and five impersonated ExpressVPN.

Both companies told TechRadar they were aware of copycat extensions on the Chrome Web Store and frequently asked Google to remove them. Cherlynn Cha, head of security operations at ExpressVPN, said copycat extensions put people at risk by giving them a false sense of security. She said the company employs an enforcement partner to search the web for unauthorised use of its name. Rebecca Rosenberg, head of growth at Windscribe, said enforcement was 'pretty much a game of whack-a-mole' because when a copycat is pulled, two more appear. TechRadar said one email address it uncovered was linked to 14 apps, with the number changing as extensions were removed and replaced.

TechRadar reported that VPN extensions can request more access than almost anything else in the Chrome Web Store. A VPN encrypts and reroutes a user's internet connection through its servers; while a legitimate service can improve privacy, it also transfers trust from the internet service provider to the VPN creator. In theory, an anonymous developer could see the websites visited, timestamps and the user's home IP address. Cha said that was a lot of trust to hand over. Rosenberg said giving data to an anonymous developer with a personal email address and a privacy policy that does not load was the opposite of privacy.

The report follows earlier warnings about VPN extensions. TechRadar said Palo Alto had previously found more than 350 apps linked to harvesting user data through traffic interception, and that 89 of those extensions were still active and available. In TechRadar's tests, 89 of the extensions were still available to Russian users, and email addresses associated with them had continued to launch more apps since the initial discovery. One address, vale99505@gmail[.]com, was first flagged by Palo Alto in July; its threat intelligence notice said the extensions did not provide typical encrypted protection like reputable VPN extensions and that the operator had access to all communication. TechRadar said six extensions linked to that address were still available for download.

Google had not responded to requests for comment at the time of publication, TechRadar said. The outlet said it had shared the full list of extensions with Google and would monitor their availability. Windscribe said Google should absolutely be doing more to protect users from untrustworthy VPN extensions on the Chrome Web Store. ExpressVPN confirmed it favoured stronger verification for privacy and security tools.