RolyPoly VPN: The Malicious “Free” VPN Extension That Keeps Coming Back

Free VPN extensions promise privacy, speed, and global access with a single click. For millions of users, they’re an easy way to bypass restrictions or hide IP addresses without paying for a subscription. But that promise often hides a tradeoff: if the product is free, your data becomes the product.

Over the past few years, a group of Chrome extensions advertising “Free Unlimited VPN” services collectively accumulated over 9 million installations. Their names, icons, and descriptions looked perfectly legitimate, and even professional. Yet behind that clean façade, two of these extensions were later revealed to contain deeply invasive code. They were available in the Chrome Web Store for nearly six years before being flagged and removed in May 2025.

Only two months later, a third extension, nearly identical in description, icon style, and internal behavior, appeared in the store. It remains available at the time of writing.

These extensions did far more than proxy network requests. They fetched hidden configuration files from remote servers, altered proxy settings in real time, and intercepted browser navigation events, functioning as remote-controlled proxy redirectors with concealed update channels. What appeared to be a simple free VPN was, in practice, a full browser-level surveillance mechanism.

In this analysis, we’ll describe how these extensions evolved, highlight the technical overlaps between them, and break down the specific techniques used to intercept, redirect, and persist inside the browser. The findings show how permissions such as webRequest, proxy, and declarativeNetRequest can give malicious actors total visibility and control over a user’s browsing traffic.

If installed, these extensions could:

• Intercept and redirect every page you visit.
• Collect browsing data and a list of installed extensions.
• Modify or disable other proxy or security tools.
• Route traffic through attacker-controlled servers, exposing private activity to potential surveillance.

Old version (notable suspicious parts)

Method hijacking

The extension overrides String.prototype.trim to remove backslashes from decoded strings — used to silently de-obfuscate and follow remote URLs.

• Complete traffic interception: By installing a remote PAC script and controlling proxy endpoints, an attacker can route user traffic through servers they control, enabling passive monitoring (logging), active injection (HTML/JS modification), credential theft, or targeted content replacement.
• Selective, stealthy redirection: With onBeforeRequest + DNR updates, the operator can land victims on phishing pages, steered download pages, or ad farms, and then change payloads later without user interaction.
• Persistent remote control: Runtime code/config fetch + DNR updates + keepalive injection allow operator to change extension behavior post-install, bypassing store review after initial publication.
• Evasion of analysis & traces: timing gates (2s direct traffic), history.replaceState, dynamic uninstall on detection. These tactics all reduce forensic evidence and sandbox detection.
• Attack surface expansion: disabling other proxy extensions or enumerating installed extensions allows targeted disabling of defensive tools.
• Privacy & profiling: collecting hashed URLs, extension lists, and potentially cookies/session tokens (if proxied to attacker servers) is a severe privacy breach and can enable targeted follow-on attacks.

These extensions show how easily a trusted browser add-on can evolve into a remote-controlled proxy system: over six years, two nearly identical “free VPN” extensions silently redirected traffic, updated their behavior through hidden configuration channels, and exfiltrated user data before removal, only for a third clone to appear two months later, demonstrating that even tools marketed for privacy can become long-lived instruments of surveillance when granted broad permissions and minimal scrutiny.

It’s worth mentioning that during our investigation, we discovered six additional, almost identical extensions. However, these were adblockers and music downloaders.

Extension IDs – Current Live Extensions

• fgpecemjbefkjlcgnhjohdonijdkfooj  – active – 30,000 Users (Chrome)
• kekfppnajjchccpkfaogiomfcncbgagc – 131,445 Users (Edge)
• nhiafglcjghpmcipelflfhkckdpcokid – active – 1,000 Users
• hfofhoffdcfcjgmilkpnhkamcgemaban – 100,000 Users

Extension IDs of Past Extensions (no longer live):

• foiopecknacmiihiocgdjgbjokkpkohc – 100,000 Users
• bibjcjfmgapbfoljiojpipaooddpkpai – 9,000,000 Users
• ngahaphlngmdfhbhkplbglnfhehnpgdb – 100,000 Users 
• ibibeegnncapfdcgpdnnbjbbojglhlmk – 20,000 Users
• anlhakiodmebohjmkbciohpglnjifjaa – 5,000 Users

Support emails / domains

• admin@free-vpn.pro
• support@free-vpn.pro
• victorbthomas6@gmail.com
• okmusic.pro@yandex.ru
• support@adsblocker.top
• facebook@adscleaner.top
• andreylebedev.ext@gmail.com
• support@yandexmusic.pro
• free-vpn.pro
• okmusic.cyou
• dialspeed.xyz
• adsblocker.top
• facebook.adscleaner.top
• vpn-professional.company
• procompany.top
• proffconfig.top
• configapp.top
• yandexmusic.pro
• configanalytics.icu

Names / branding

• “VPN Professional – Free Secure and Unlimited VPN Proxy Chrome Extension”
• “VPN-free.pro – Free Unlimited VPN”
• “Free Unlimited VPN”
• “VPN Professional – Free Unlimited VPN Proxy”
• “Ads Blocker”
• “OKmusic – скачать музыку и видео Одноклассники | OK.ru Music Downloader”
• “Ads Cleaner for Facebook”
• “Speed Dial | Bookmarks | New Tab Page | Quick Access | Custom Search”
• “Скачать музыку” (“Download Music”)

Immediate actions for end users:

1. Uninstall any extension matching the IOCs above.
2. Clear browser cookies, local storage, and any stored credentials that may have been captured while the extension was active.
3. Rotate passwords for sensitive accounts (especially if you used the browser for logins while the extension was active).
4. Run an anti-malware/anti-adware scan locally.

Enterprise / SOC actions:

1. Block identified support domains and C2 hosts at the network perimeter (DNS + proxy + firewall) while investigating.
2. Query telemetry for extension installs and PAC changes (EDR/MDM: look for registry or preference modifications used to set PACs).
3. Revoke sessions for critical services if any traffic was proxied through attacker hosts.
4. Notify users and require reinstallation of browsers or profile resets for impacted endpoints as necessary.
5. Report the extension(s) to the Chrome Web Store with detailed IOCs and supporting evidence.