Plan
active
737 fake Chrome VPN extensions route traffic via rogue SOCKS5 proxies
- Engineer — Plan: Audit any corporate-managed Chrome extensions against a blocklist of the 737 identified fakes; establish a policy requiring allowlisted extensions only for managed devices.
- SOC/IR — Plan: Build detection for unusual SOCKS5 proxy egress from endpoints, and consider hunting for browser extension IDs associated with this campaign in endpoint telemetry.
- Leader — Learn: Illustrates scale of Chrome Web Store supply-chain risk for enterprise endpoints; useful context for policy decisions around browser extension governance, but no immediate board-level action required.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.