369 Shady VPN Extensions Target Russian Chrome Users, Including Fake Windscribe and ExpressVPN

As Russia squeezes VPN use harder every month, the Chrome Web Store is filling up with VPN extensions aimed at Russian users that nobody can vouch for. A TechRadar investigation published on 22 October found 369 of them that fail basic transparency tests, with more than 218,000 users between them. Some borrow the names of real VPNs, including Windscribe and ExpressVPN.

None of them is confirmed to be malicious. That’s not the reassurance it sounds like.

What TechRadar found

According to the TechRadar investigation, by Samuel Woodhams with contributions from Mike Williams:

• 369 extensions on the Chrome Web Store target Russian users and fail basic transparency checks.
• Over 218,000 users have installed them in total.
• 70 developers are linked to all of them. One email address alone is tied to 24 apps.
• More than 120 use names tied to legitimate brands. The most copied name is Happ, a proxy client popular in Russia, used by more than 15 extensions.
• Seven imitate Windscribe and five impersonate ExpressVPN.

TechRadar is careful: it doesn’t say these extensions are malware. The issue is that they’re anonymous. Nobody knows who runs them, where the traffic goes, or what’s done with it. And a VPN extension, by design, sees a lot of what you do in your browser.

TechRadar also went back to an earlier warning. Palo Alto Networks had previously flagged more than 350 apps linked to harvesting user data through traffic interception. TechRadar found 89 of them still available.

Google hadn’t responded to a request for comment at publication. TechRadar says it shared the full list with Google and will monitor whether the extensions stay up.

Why Russia, and why now

Demand is the obvious answer. Russia has spent the past two years blocking VPN protocols, removing VPN apps from app stores and fining people for advertising them. We’ve tracked how the authorities detect VPN traffic in our piece on Russia’s VPN detection methods.

The pressure isn’t easing. On 19 October, TechRadar reported on a Kommersant story that Russian authorities had explored using AI to identify and block VPNs, with a claimed 95% effectiveness, as part of a draft national AI plan through 2030. The Digital Development Ministry says that measure isn’t in the plan’s current version. The same draft would increase traffic-filtering capacity 2.5-fold to 954 terabits per second by 2030.

When the big apps are hard to get and people are desperate for anything that connects, anonymous lookalikes fill the gap. A Chrome extension is especially easy to publish and easy to install, with no app store review as strict as Apple’s.

Why a sketchy VPN extension is worse than no VPN

A browser VPN extension usually needs permission to “read and change all your data on all websites”. That’s how it routes your browsing. It also means the developer’s code can see the pages you open and, in principle, what you type into them.

We’ve already seen what that access can be used for. In December 2025, researchers found that the Urban VPN Proxy extension, which had a “Featured” badge on the Chrome Web Store, was capturing users’ AI chatbot conversations and sending them to its servers. We cover the case in is Urban VPN safe?

For Russian users specifically, the risk goes further. If an anonymous VPN extension logs your traffic, you have no idea who could end up with those logs.

How to spot a fake VPN extension

Before installing any VPN extension, check these:

1. The developer name. On the extension’s store page, scroll to the developer details. A real Windscribe or ExpressVPN extension is published by the company itself, with a link to its official website.
2. Install from the provider’s site. Go to the VPN’s own website and use its download link for the Chrome extension. Don’t search the store and click the first result.
3. The website and privacy policy. No website, a generic page, or a privacy policy that doesn’t name a company are all red flags.
4. User numbers and reviews. A “famous” VPN with a few hundred users is not that VPN. Read the low-star reviews, not just the five-star ones.
5. Whether there’s a paid plan. A VPN with no subscription and no ads still has server bills. Ask how it pays them.
6. Whether you need an account with the real service. Real Windscribe and ExpressVPN extensions require you to log in to your account with that provider.

If you’ve installed something that fails these checks, remove it: in Chrome, click the puzzle icon, then Manage extensions, then Remove. Then change the passwords for any sites you logged in to while it was active.

Real extensions from audited providers

Several of the VPNs in our database have genuine Chrome extensions, published by the providers themselves. From our data (scores out of 5):

Our guide to the best VPN Chrome extensions compares them in detail. Keep in mind that an extension only protects your browser. For apps, games and system traffic, you need the full desktop or mobile app.

If you want one we’d trust, NordVPN’s extension is published by Nord Security, covered by a PwC-audited no-logs policy, and part of the top-rated VPN in our database.

Get NordVPN and its official Chrome extension

Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.

This isn’t only a Russian problem

The investigation focused on extensions aimed at Russian speakers, but the pattern isn’t limited to Russia. Search “free VPN” in any browser’s extension store and you’ll find dozens of near-identical listings with generic names, stock logos and no company behind them. Whenever demand spikes (a new age-verification law, a blocked social network, a big sports event behind a paywall), more appear. The checks above work in any language and any country.

What about users inside Russia?

We can’t give legal advice, and the situation in Russia changes fast. What we can say is that the risk of an unknown extension is higher there, not lower. If you need a VPN in Russia, set it up before you travel, use the provider’s own app rather than a store search, and keep a second option ready in case one gets blocked. Our best VPN for Russia guide covers what still works and what to watch.

Our take

What bothers us most is the scale. One store lets hundreds of anonymous developers publish tools that sit between users and everything they do online, with brand names borrowed from companies they have nothing to do with. Google’s response, when it comes, will tell us whether the Chrome Web Store treats VPN extensions as the high-risk category they are.

Until then, the rule is simple: if you can’t tell who runs a VPN, don’t install it.