I often tell people to think of fake VPNs like kitchen funnels. Instead of pouring your network traffic directly into the wild web and spilling your metadata everywhere, you push it down a narrow tube of encryption. You point your connection exactly where it needs to go without leaking data all over the place.
Of course, the assumption in such an arrangement is that you trust your provider. If your provider is actually a honeypot for attackers to pry away your data, you’ve just traded several possible security risks for one guaranteed security breach. According to threat researchers at Socket, that is exactly what has been happening with over seven hundred fake VPNs listed on the Chrome Web Store.
Just as you would optimize your computer’s workflow using our popular Mac Finder hacks, you must actively optimize your browser security. Many of these malicious extensions are free, some are paid, and others pretend to be from trusted cybersecurity providers to lure you into handing over unrestricted network access. Let’s dig into exactly what is going on with these fake VPNs and how they managed to clear Web Store moderation.
What Researchers Found Analyzing Fake VPNs
Socket’s threat research team analyzed 737 suspicious Chrome extensions claiming to offer secure proxy servers. They uncovered paid apps selling access to servers that do not exist, extensions that hijack your proxy to track online activity, and several attempts to impersonate trusted platforms.
When they looked deeply into these fake VPNs, they found that they were published by just 40 developer accounts but had racked up 75,486 installs. Socket performed a detailed code analysis on 525 of these extensions and found shocking results:
- Brand Impersonation: 274 extensions plagiarized the branding and logos of 66 reputed providers, including Proton VPN, Surfshark, NordVPN, and ExpressVPN.
- Fixed Proxies: Each extension pointed to a fixed SOCKS5 proxy without split tunneling or per-site controls, forcing all activity through a single compromised server.
- DNS Evasion: 104 extensions used documented DNS-over-HTTPS evasion techniques to get around Chrome’s blocklists by spoofing their DNS records.
- Ghost Servers: Many advertised premium tiers with private servers in Japan, Singapore, Canada, Australia, and Turkey. However, these servers do not exist; their hostnames failed to resolve during DNS lookups.
- Zero Real Routing: One specific extension, Burёnka VPN, didn’t route traffic through any servers at all. It was just a hollow UI pretending to be a real app.
How Fake VPNs Bypass Chrome’s Review Process
The best-laid cyber attacks aren’t always the most sophisticated. None of these fake VPNs used code that was particularly difficult to flag in a thorough review. They slipped past Chrome’s defenses because the developers spent time studying Web Store review processes, learning to evade rejections through repeated trial and error.
Even when a developer’s account gets pulled, opening a new one only costs $5. Between the 40 developer accounts mentioned in the report, it barely cost $200 to publish over 700 fake VPNs that successfully compromised tens of thousands of browsers.
It also helped that most of these extensions were angled toward Russian citizens trying to bypass regional censorship regulations. However, it is a massive mistake to dismiss fake VPNs as a regional threat. Chrome’s Web Store policies paint a troubling pattern of lax security reviews, and this exact playbook can easily be adapted to target users in the U.S., UK, or the EU. In fact, Google itself issued a critical warning in 2025 regarding similar fake VPNs flooding the Play Store for Android users.
How to Spot Fake VPNs Before You Install Them
Since you cannot rely on app store review processes alone, you need ways to spot fake VPNs before they embed spyware into your daily browsing. Thankfully, you do not have to reverse engineer manifest files to stay safe.
Follow these critical steps to verify your browser extensions:
- Use Official Links: Install extensions by following a link directly from the provider’s official website, never from the Web Store search bar.
- Vet the Developer: Before you install an extension, look past the user reviews and click on the developer account. Check if the account is officially associated with the correct parent company.
- Verify Your IP: Use a tool like WhatIsMyIPAddress (Note: Set to NoFollow) to check your currently visible IP address. Confirm that it perfectly matches the IP address displayed in your extension’s interface.
- Run a DNS Leak Test: While your connection is active, run a DNS leak check. If your real IP address, general location, or original internet service provider (ISP) shows up in the test results, that is a massive red flag.
Staying vigilant against fake VPNs ensures your private data stays inside the encrypted funnel—and out of the hands of cybercriminals.
