PrivadoVPN

The extension presents itself as 'PrivadoVPN' — a brand name used by a real, established VPN provider (privadovpn.com) — but all premium upsell flows redirect to 'Myxa VPN' (myxavpn.pro) via affiliate/referral links. The popup text at line 73 explicitly names 'Myxa VPN' as the actual provider. Users searching for or trusting the PrivadoVPN brand will instead have their traffic and payment routed through a completely different unrelated operator, constituting brand impersonation.

var PREMIUM_URL = "https://app.myxavpn.pro/auth?ref=58ca6bb8-4756-4431-9c64-9b2f47aade63";var TG_BOT_URL = "https://t.me/myxavpn_bot?start=58ca6bb8-4756-4431-9c64-9b2f47aade63";var SITE_FALLBACK_URL = "https://app.myxavpn.pro/auth?ref=58ca6bb8-4756-4431-9c64-9b2f47aade63";

On first install the extension silently opens a new active tab to securepulse.space without any user interaction. While common in some extensions, combined with the brand impersonation finding this constitutes unsolicited navigation to the actual operator's domain that differs from the CWS-listed extension identity, potentially used to track installation events or deliver further content.

chrome.runtime.onInstalled.addListener((details) => {  chrome.action.setBadgeText({    text: ""  });  if (details.reason === "install") {    chrome.tabs.create({      url: "https://securepulse.space",      active: true    });  }});