Over 350 untrustworthy VPN extensions on Chrome Web Store target Russian users

Privacy and security risks identified

TechRadar’s investigation uncovered more than 350 VPN extensions on Google’s Chrome Web Store that target Russian users. Collectively, these extensions have amassed over 218,000 users, despite 89 of them being previously flagged as dangerous by cybersecurity firms like Palo Alto Networks. Many of these extensions remain active, exposing users to potential data harvesting and other privacy risks.

Nearly three-quarters of the extensions host their privacy policies on Telegra.ph, an anonymous platform linked to Telegram. This practice makes it difficult for users to verify how their data is being handled or who is responsible for the extensions.

Signs of review manipulation and brand impersonation

The investigation found that 47% of the extensions have more reviews than active users, a red flag for artificial review inflation. This tactic is often used to mislead users into believing the extensions are trustworthy.

Over 120 extensions imitate legitimate VPN brands, including seven impersonating Windscribe and five mimicking ExpressVPN. The Russian VPN brand Happ was co-opted by more than 15 extensions, further blurring the line between genuine and fake tools.

Rebecca Rosenberg, Head of Growth at Windscribe, and Cherlynn Cha, Head of Security Operations at ExpressVPN, confirmed the challenges of combating these copycats. ExpressVPN employs an enforcement partner to scour the web for unauthorized use of its name, but the process is described as a "game of whack-a-mole."

Anonymous developers and coordinated activity

Almost all the extensions analyzed list anonymous Gmail addresses as developer contacts, rather than professional or verifiable details. This lack of transparency raises concerns about accountability and the potential for malicious actors to exploit users’ trust.

One email address—vale99505@gmail[.]com—was linked to 24 individual extensions. According to TechRadar, none of these extensions provide "typical encrypted protection like reputed VPN extensions," suggesting a coordinated effort by a small group of developers to flood the Chrome Web Store with untrustworthy tools.

Palo Alto Networks had previously identified over 350 apps linked to data harvesting via traffic interception. Despite these warnings, 89 of the extensions remain available to Russian users.

Demand for VPNs in Russia amid digital crackdown

Since Russia’s full-scale invasion of Ukraine in 2022, the government has intensified its crackdown on digital freedoms, making VPNs a critical tool for millions of Russians seeking unrestricted internet access. This surge in demand has created an opportunity for malicious actors to exploit users looking for privacy solutions.

While there is no evidence linking these extensions to Russian authorities, TechRadar noted that their design suggests an intent to monitor users’ browsing behavior under the guise of providing privacy tools.

The Russian government is reportedly developing AI tools to detect and block VPN traffic, adding urgency for users to identify trustworthy providers amid a crowded and risky market.

Google’s role and platform accountability

Google had not responded to TechRadar’s requests for comment at the time of publication. The investigation highlights concerns about the Chrome Web Store’s vetting processes, particularly for extensions handling sensitive user data.

The persistence of these extensions—despite prior warnings from cybersecurity firms—raises questions about the balance between user convenience and security on major platforms.

Broader context: Platform risks and regulatory scrutiny

This investigation follows recent reporting on Google’s broader platform challenges. A German court recently ruled that Google’s aerial and satellite imagery services violate privacy laws, requiring advance warnings to property owners before capturing images. Separately, European financial regulators are scrutinizing Google after a cloud outage disrupted banking services for millions.

The findings also align with concerns about AI and digital infrastructure. While Google Cloud has expanded its AI model offerings, including OpenAI and Gemini, the presence of unvetted or malicious software on its platforms underscores the need for stronger safeguards, particularly in regions with restricted digital freedoms.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

For founders and operators in the cybersecurity and VPN space, this investigation highlights the risks of brand impersonation and the challenges of maintaining user trust in a crowded market. The prevalence of anonymous developers and manipulated reviews on the Chrome Web Store underscores the need for proactive monitoring and enforcement to protect both users and brand reputation.

The investigation also raises broader questions about platform accountability. If Google fails to address these gaps, it could face regulatory pressure or reputational damage, particularly in regions where privacy concerns are already heightened. For users in restrictive environments like Russia, the stakes are even higher, as the line between genuine privacy tools and malicious software becomes increasingly blurred.

Related on Lazyfounder

• Google
• Palo Alto Networks
• More technology news
• German court rules Google’s aerial imagery on Maps and Earth violates privacy laws