9 Million Installs: Malicious Chrome VPN Extensions Hijack User Traffic Via Remote PAC Proxy Injection

SecurityOnline[.]info reports that LayerX researchers have exposed a long-running malicious campaign in VPN and ad-blocking Chrome extensions designed to intercept traffic, exfiltrate data, disable security tools, and redirect users through attacker-controlled servers, all presented as free privacy tools.

The campaign spans more than six years and has accumulated over 9 million installs, with a new variant uploaded in July 2025 still available in the Chrome Web Store, despite prior takedowns; earlier versions were removed in May 2025.

The extensions, including VPN Professional – Free Secure and Unlimited VPN Proxy, VPN-free[.]pro – Free Unlimited VPN, and Free Unlimited VPN (2025 version, still live), hijack and redirect every page visited, install remote PAC proxy scripts, download dynamic updates and payloads, and collect a list of installed extensions, among other surveillance features.

At the time of publication, a 2025 extension variant already has 31,000+ active installs, and LayerX notes the newer version is more stealthy, adding delayed proxy activation, runtime-downloaded scripts, and remote code execution capabilities. The researchers emphasise that these extensions effectively function as remote-controlled proxy redirectors with concealed update channels, not merely simple VPN tools.