Researchers found 737 Chrome VPN/proxy extensions that impersonated well-known privacy brands and routed users’ browser traffic through attacker-controlled SOCKS5 proxies. The activity mainly targeted Russian-speaking users trying to access blocked services, putting the operator in a position to observe browsing destinations and other metadata. Google removed some extensions, but many were still active at the time of reporting.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
That “free Chrome VPN” you just installed? It might be sending every site you visit through someone else’s server. Researchers found 737 Chrome VPN and proxy extensions, many in Russian, impersonating brands like Proton VPN, NordVPN, and Surfshark. Behind the scenes they set Chrome to use a fixed SOCKS5 proxy on port 1082, so one provider sits in the middle of your entire browser session. The trick: a slick fake interface. The extension shows a nice connect animation and status “Connected”, but tests show every VPN connection fails while your real browsing still goes through their proxy. Many even promise fake premium locations that don’t exist. Your move: if you use a VPN in Chrome, open the extension’s page and check the publisher. If it’s not the official vendor, remove it now, don’t let a fake VPN sit in the middle of your browsing.
This weekly roundup includes real-world social engineering campaigns, including scammers mailing fake IRS letters to cryptocurrency holders and a phishing campaign impersonating Bank of America. The lures are designed to pressure victims into visiting a bogus compliance portal or installing remote…
Researchers report attackers compromising hotel and venue Wi‑Fi “captive portal” gateways to redirect Microsoft 365 sign-ins to attacker-controlled lookalike domains. Victims can have their Microsoft 365 credentials stolen without clicking a phishing link or installing malware, because the…
Microsoft says a Russian-linked group is abusing hotel and conference Wi‑Fi “captive portals” to trick travelers into entering corporate credentials or installing malware. Victims see what looks like a normal Wi‑Fi login flow, but attackers manipulate DNS/website traffic to redirect them to fake…
Researchers say criminals are cloning popular GitHub repositories for AI tools and developer resources, then quietly changing installation instructions to deliver an infostealer. The pages look legitimate (including original contributors), which lures developers into downloading and running a ZIP…
Researchers described an active phishing campaign that tricks people with fake Adobe/Zoom update and “document review” themes to install the legitimate ScreenConnect remote-access tool. Once installed, attackers get persistent remote control of the victim’s computer while blending in as normal IT…
This roundup describes real-world social engineering, including phishing emails that impersonate ChatGPT billing to steal payment card data and a convicted attacker who posed as Snapchat support to trick people into handing over login codes. The common theme is impersonation of trusted brands to…
