Security Alert: Confirmed Malware

This extension was removed from the Chrome Web Store as malware. Do not install it.Extension: Expressvpn For PC -secure Vpn proxy

CRITICAL RISKRemoved from Chrome Web Store

Expressvpn For PC -secure Vpn proxy

ID: baklbapcohbgnpdgjhegmieeofbbgpad

Could be malicious

Supported Languages

🇸🇦Arabic

🇧🇩Bengali

🇧🇬Bulgarian

🇨🇳Chinese (Simplified)

🇩🇰Danish

🇳🇱Dutch

🇺🇸English

🇫🇮Finnish

🇫🇷French

🇩🇪German

🇮🇱Hebrew

🇮🇹Italian

🇳🇴Norwegian

🇵🇱Polish

🇷🇺Russian

🇪🇸Spanish

🇮🇳Tamil

🇺🇦Ukrainian

🇻🇳Vietnamese

Extension Info & Metadata

Status

Removed

Version

16.4

Size

5.04 MB

Rating

2.9/5

Reviews

Users

6,000

Type

Extension

Updated

Oct 12, 2022

Publisher Contextual Analysis

Author: https://expressvpnforpc.blogspot.comView Profile
Privacy: Privacy Policy
MX records exist: Yes
Domain exists: Yes
Is disposable: No
Is role-based: No
Mailbox exists: Yes
Website: Visit

Total Extensions

Active

Obsolete

Listed

Unlisted

Total Users

6,000

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Expressvpn extension for Google Chrome-unblock browser restriction!Recomended proxy protect,encrypt connection

Expressvpn extension for Google Chrome-unblock browser restriction! Recomended proxy protect, encrypt connection VPN Proxy Security | Best VPN | Fast, Secure & Unblock Sites | Free Activity | Forget Copyright | Hotspot Shield Reasons to use this extension: →Expressvpn VPN -secure Vpn proxy for Chrome is the fastest and easy in using Proxy service starts working by one click in your browser. →It’s nobody’s business what you do online!!! →That’s why we don’t track, collect or share your private data.

User Growth

Showing data from Oct 13, 2022 to Oct 12, 2023

Versions

+20%(+1,000 users)

Compared to 3 months ago

1 version released in this period

Rating Count

Total: 11 ratings+1 (10%)

Average Rating

Current: 3.55 / 5.0+3.55

Extracted Data

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

By severity

Critical5

High2

Medium1

Low0

Versions scanned

Showing 1 of 1 scanned version with more than one unique finding. Counts are unique findings that include each version.

Extension Version	Code Review Findings
16.4 Code review	8

Extension Version	Code Review Findings
16.4	8

Files with findings

3 distinct paths — top paths by unique finding count:

js/background.js4
service_worker.js3
manifest.json1

S.No.	Category	Severity	File	Summary	Found in Version
1	Credential Theft	critical	js/background.js (line 8244)	Critical-severity targets include eBay payment pages (cart.payments.ebay.com/.ca/.co.uk/.de/.com.au), eBay session-ID URLs, Airbnb trip/host pages, Walmart orders, Agoda flights, and Etsy cart — all rewritten to gidan…	16.4
2	Network Interception	critical	js/background.js (line 8)	The ExpressVPN-branded extension ships with ~1,357 hard-coded URL-redirect rules that target shopping cart, checkout, and payment pages on legitimate e-commerce and travel sites, all rewriting to an attacker-controlle…	16.4
3	Network Interception	critical	js/background.js (line 8469)	The tabs.onUpdated listener watches every navigation in every tab and, while the page is still 'loading', silently calls chrome.tabs.update() to swap the URL to the attacker's destination. The 'locations' bookkeeping …	16.4
4	Phishing	critical	service_worker.js (line 44)	The remotely-fetched config is passed unvalidated into chrome.tabs.create() to silently open arbitrary attacker-supplied URLs on first install, and into chrome.runtime.setUninstallURL() to redirect users to an attacke…	16.4
5	Remote Code Loading	critical	service_worker.js (line 9)	On every service worker startup, the extension contacts an attacker-controlled C2 endpoint at test2.mylovelyfont.com (a domain unrelated to ExpressVPN) to fetch a JSON-encoded settings blob. The fetched configuration …	16.4
6	Network Interception	high	js/background.js (line 8404)	matchUrl() compiles each rule's src as a RegExp and rewrites the URL via String.replace, which means attacker-controlled regex patterns (originally embedded, but also editable via the options page or syncOptions messa…	16.4
7	Phishing	high	manifest.json (line 1)	The extension impersonates ExpressVPN by name, icon, and description, but is not published by ExpressVPN and points its host_permissions at ninjavpn.io (an unrelated proxy operator). The 'management' optional permissi…	16.4
8	Obfuscation	medium	service_worker.js (line 1)	The service worker tries to importScripts two minified files (proxy.min.js, background.min.js) that are not present in the shipped bundle, with the failure swallowed by a try/catch. This indicates the extension was as…	16.4

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

URLs

282

IPv4

IPv6

URLs

View the external URLs this extension communicates with to understand its network activity and data interactions.

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


getbootstrap.com	-	https://getbootstrap.com/
github.com	/twbs/bootstrap/blob/master/LICENSE	https://github.com/twbs/bootstrap/blob/master/LICENSE
www.w3.org	/2000/svg	http://www.w3.org/2000/svg
fontawesome.com	-	https://fontawesome.com
fontawesome.com	/license/free	https://fontawesome.com/license/free
meyerweb.com	/eric/tools/css/reset/	http://meyerweb.com/eric/tools/css/reset/
fontawesome.io	-	http://fontawesome.io
fontawesome.io	/license	http://fontawesome.io/license
www.w3.org	/Graphics/SVG/1.1/DTD/svg11.dtd	http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd
www.apple.com	/http://www.apple.com/http://www.apple.com/Copyright	http://www.apple.com/http://www.apple.com/http://www.apple.com/Copyright

Showing 1 to 10 of 290 rows

Rows per page:

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.


10.0.0.0	IPv4	-
255.0.0.0	IPv4	-
172.16.0.0	IPv4	-
255.240.0.0	IPv4	-
192.168.0.0	IPv4	-
255.255.0.0	IPv4	-
127.0.0.0	IPv4	-
255.255.255.0	IPv4	-
6.6.6.6	IPv4	-

1.0 out of 5 · 10 most recent reviews

Text reviews

Positive

Negative

Никак

ВЗ

Владислав Зелинский·25 Mar 2025

کار نمیکنه اینم

hamid sabaghi·17 Mar 2025

کص ننتون با این گی پی ان کیری شما مادرتون کیر میخوره

Baktash Chinianpour·1 Nov 2024

Version History

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Browse and explore files within this extension package

You reached today's free scan limit (3/3 unique extensions).

Upgrade for full visibility.

Security Alert: Confirmed Malware

Expressvpn For PC -secure Vpn proxy

Supported Languages

Extension Info & Metadata

Publisher Contextual Analysis

Chrome Web Store Metadata

About this extension

Analytics & Metrics

User Growth

Rating Count

Average Rating

Static Code Security Analysis

Extracted Data

Code Review Findings Summary Across 1 Version8

Versions scanned

Files with findings

Extracted Indicators (URLs and IPs)

URLs

Contextual Analysis

User Reviews

Version History

Version-to-Version Code Diff

Extension Files

User Reviews

User Growth

Rating Count

Average Rating