Google Chrome Web Store removes 3 fake VPN extensions that infect 1.5m users

Three counterfeit VPN extensions were discovered by security researchers at Reason Labs, with a total of 1.5 million installations. Google has since removed these plugins from the Chrome web store.

Beside the Web Store website, the malicious extensions were found to have been distributed through torrent files of popular video games such as Grand Theft Auto, The Sims 4, Heroes of Might and Magic III, and Assassin's Creed. Reason Labs identified the Trojan installer in over 1,000 torrent files.

After Reason Labs notified Google of their findings, the extensions were removed from the Chrome Web Store. However, this action was taken only after the extensions had accumulated a total of 1.5 million downloads. Two extensions, netSave for Chrome and netPlus for Microsoft Edge, were discovered to be installed on the user's system. The malicious Chrome plugin alone had been installed 1 million times.

Once installed, the extension would disable other plugins in the browser and provide a fake VPN interface to conceal its true intentions from the user. These fake plugins were created in Russian, indicating a focus on Russian-speaking regions such as Russia, Ukraine, Kazakhstan, and Belarus.

Reason Labs also warned that the extension developer may have created other harmful plugins. They advised users to only install extensions, games, and programs from legal sources and to use the latest versions of antivirus software. Users were also urged to avoid opening unknown links and pop-ups, as well as to enable two-factor authentication for added security.

With the rising popularity of VPNs among internet users who prioritize privacy and security, it is crucial to remain cautious about the authenticity and reliability of VPN extensions. Counterfeit VPN extensions can subject users to potential risks and jeopardize their data. It's essential for users to thoroughly investigate the reputation and reviews of any VPN extensions they plan to use and refrain from downloading from unverified sources.

Source