What we find in the stores we catalog
We download, unpack and rate every extension in the Chrome Web Store and Firefox Add-ons, and every package crossing ten registry firehoses. These are the things worth writing down.
Where a finding is someone else's, we say so and link them. Where our own detection missed something, we say that too — the second kind is usually the more useful post.
A “VPN” with 70,000 users that is not a VPN
Three Chrome extensions borrow the names of ZenMate and ExpressVPN. They cannot route your traffic anywhere — they never ask for the permission that would let them. What they do instead is send the address of every page you look at to a third-party server, without encryption.
215 fake VPN extensions are still on the Chrome Web Store
A VPN extension is a strange thing to fake, because a fake one gets exactly what a real one gets: the ability to see and redirect everything you do online. Twelve groups of extensions each impersonate several competing VPN brands from one shared codebase — and all 215 are still installable today.
More as we find it. The extension catalog behind this work is browsable at /extensions, and the live package feed at /threats.