DIQQAT! Soxta VPN is routing traffic through various proxy servers!

Multiple fake VPN tools have been identified that redirect browser traffic through unknown proxy servers. These tools are installed approximately 356 thousand times. Some of these tools offer access to services like RuTracker, YouTube, Telegram, and various AI platforms. Experts note that these tools can change browser proxy settings and route internet traffic through unknown servers using proxy permissions granted during installation. One extension, RuTracker VPN, has about 200 thousand installations. The attack mechanism involves routing user traffic through an extension to an unknown proxy server, where configuration data is stored externally on sources like GitHub Pages or Telegram channels, allowing remote modification of routing without updating the extension itself.

The danger lies in the decoupling of perceived security (VPN) from actual traffic control, facilitated by exploiting specific Chrome extension permissions, particularly proxy settings and URL access. The pattern observed is one of systemic obfuscation: using seemingly benign software interfaces to mask fundamental network routing decisions. Attackers shift the persistence burden from local code to external, mutable configuration sources, creating a highly adaptable infrastructure where remote changes can alter traffic flows without updating the application itself. This erodes user agency because security assurances are based on superficial identification rather than verifiable control over the execution environment. The ability to handle HTTPS traffic does not negate surveillance; instead, it shifts the adversary's focus to metadata monitoring, suggesting that privacy is increasingly defined by controlling visibility and access patterns rather than data encryption alone. What alternatives exist for establishing network control that rely less on a single point of trust in the application layer?