Chrome Web StoreCaution required
Suspicious in code review
Our reviewer found behaviour consistent with malware, but not enough to confirm it. Treat this extension as untrusted until it has been re-reviewed.
1 critical finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
What our analysis found
ExpressVPN is rated caution by Extension Auditor. Our code review reported 2 findings (1 critical, 1 high), led by network interception. It comes from a publisher with 22 extensions and was last updated in June 2026.
Key findings
- Critical
Network Interception
All browser traffic is silently redirected through SOCKS5 servers at bare IP addresses (e.g.,) operated by an anonymous entity with no public audit, no verifiable jurisdiction, and a [domain withheld] blog post as a privacy policy. Users who install this extension believing it is the real ExpressVPN will have their full HTTP request contents and TLS server-name-indication data exposed to the operator with no meaningful accountability or transparency. This is the MitM infrastructure enabled by the phishing-via-brand-impersonation entry vector.
- High
Phishing
The extension is named 'ExpressVPN' but its author is 'Авокадо Team' with homepage [domain withheld] — it has no affiliation with the real ExpressVPN brand ([domain withheld]). This is deliberate brand impersonation designed to attract installs from users seeking the legitimate product. The popup code (:195) further reveals the actual backend service is 'Myxa VPN' at [domain withheld], proving the ExpressVPN name is purely a deceptive lure.
Analyst notes
This extension impersonates the real ExpressVPN brand (a well-known commercial VPN) to deceive Russian-speaking users into routing all browser traffic through SOCKS5 proxies operated by an unrelated anonymous entity ('Авокадо Team' / 'Myxa VPN' at [domain withheld]). The manifest names the extension 'ExpressVPN' with homepage [domain withheld] and the popup explicitly names the actual provider as 'Myxa VPN' — this is deliberate brand hijacking.:171–208 unconditionally routes 100% of browser traffic through bare IP-addressed SOCKS5 servers (e.g.) with no public attribution, giving the operator full visibility into all HTTP traffic and TLS SNI. The permhash cluster has 6% malware rate, the privacy policy is a [domain withheld] blog post (not a legitimate company document), publisher is a single Gmail account with 21 other extensions, and the extension is 11 days old with only 54 users — all corroborating signals. Third-party risk score's 'low impact' rating is underweighted given the proxy permission enables full traffic interception.
ExpressVPN Chrome extension security report
ID: dpbilbpinfjkhciajdcifndlpegepokc
Supported Languages
Extension Info & Metadata
Publisher Contextual Analysis
- Author
- norkienej@gmail.com
- Privacy
- Privacy Policy
- MX records exist
- Yes
- Domain exists
- Yes
- Is disposable
- No
- Is role-based
- No
- Mailbox exists
- Yes
Screenshots & videos
Install growth
- 1 critical
- 1 high
The file, code excerpt and explanation behind each finding are part of the full report. No conclusion has been withheld — only the evidence. The verdict above already reflects everything found here.
1 critical finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
About this extension
Простой и удобный VPN для браузера
Read the publisher’s full description
ExpressVPN — простое и удобное расширение для браузера, которое помогает управлять proxy-подключением прямо в Chrome. Расширение создано для пользователей, которым нужен понятный инструмент для подключения через proxy без сложных настроек. Интерфейс позволяет быстро выбрать сервер, включить или отключить подключение и видеть текущий статус работы. Главная особенность ExpressVPN — выбор сервера в один клик. Это удобно для ежедневного использования, когда важно быстро переключаться между доступными локациями и сохранять понятный контроль над соединением.
User reviews
Extension files
Browse and explore files within this extension package
Gain full insight into all external connections.
Upgrade for full visibility.
URLs
View the external URLs this extension communicates with to understand its network activity and data interactions.
1 critical finding in this extension’s code
Every finding is verified by a security analyst. Unlock the code evidence, indicators and version history.
Gain full insight into all external connections.
Upgrade for full visibility.
Related extensions
More from norkienej@gmail.com
- PrivadoVPN690 users
- Urban VPN509 users
- Browsec VPN220 users
- Orbit Proxy VPN205 users
- Happ VPN158 users
Popular in Privacy & Security
- McAfee® WebAdvisor161,000,000 users
- uBlock Origin Lite21,000,000 users
- Imprivata Enterprise Access Management20,000,000 users
- Kaspersky Protection19,000,000 users
- VPN for Chrome: NordVPN proxy protection15,000,000 users