ExpressVPN

All browser traffic is silently redirected through SOCKS5 servers at bare IP addresses (e.g. 103.35.189.225:1082, 80.92.204.33:1082) operated by an anonymous entity with no public audit, no verifiable jurisdiction, and a Telegra.ph blog post as a privacy policy. Users who install this extension believing it is the real ExpressVPN will have their full HTTP request contents and TLS server-name-indication data exposed to the operator with no meaningful accountability or transparency. This is the MitM infrastructure enabled by the phishing-via-brand-impersonation entry vector.

function engageTunnel(nodeId) {  const node = SERVERS.find(function(s) {    return s.id === nodeId;  });  if (!node) return false;  const config = {    mode: "fixed_servers",    rules: {      singleProxy: {        scheme: "socks5",        host: node.host,        port: node.port      },      bypassList: BYPASS_LIST    }  };  chrome.proxy.settings.set({    value: config,    scope: "regular"  }, function() {    if (chrome.runtime.lastError) {      relayActive = false;      chosenNode = null;      return;    }    relayActive = true;    chosenNode = nodeId;  });  return true;}

The extension is named 'ExpressVPN' but its author is 'Авокадо Team' with homepage securepulse.space — it has no affiliation with the real ExpressVPN brand (expressvpn.com). This is deliberate brand impersonation designed to attract installs from users seeking the legitimate product. The popup code (core.js:195) further reveals the actual backend service is 'Myxa VPN' at myxavpn.pro, proving the ExpressVPN name is purely a deceptive lure.

{  "manifest_version": 3,  "name": "ExpressVPN",  "version": "1.0.0",  "description": "Простой и удобный VPN для браузера",  "author": "Авокадо Team",  "homepage_url": "https://securepulse.space",  "permissions": [    "proxy"  ]