What our analysis found

Windscribe VPN - бесплатный впн для Chrome is rated malicious by Extension Auditor. Our code review reported 3 findings (2 critical, 1 high), led by phishing. It comes from a publisher with 10 extensions and was last updated in July 2026.

Key findings

• critical· phishing —The extension wholesale impersonates the Windscribe VPN brand (name, theme 'windscribe-gale', icon, UI language) but routes traffic through, a domain completely unaffiliated with the legitimate Windscribe company (). The publisher is a Gmail account with no ties to Windscribe Limited. This is a classic brand-impersonation attack designed to deceive users into trusting an attacker-controlled proxy.
• critical· network interception —When enabled, the extension redirects all browser traffic (scope: 'regular', mode: 'fixed_servers') through via HTTPS proxy — an attacker-controlled server. The only bypass is '<local>' (LAN addresses), meaning all internet-bound requests including authenticated sessions, cookies, and form data flow through the attacker's infrastructure. An HTTPS proxy can perform certificate interception and all traffic.
• high· other —The proxy destination domain bears no relationship to the impersonated brand (). The privacy policy is hosted on (an anonymous paste site) and the publisher-level policy on references 'Touch VPN' (a different VPN brand), demonstrating this publisher impersonates multiple legitimate VPN products. There is no legitimate corporate identity behind this extension.

This extension is a deliberate brand impersonation of the legitimate Windscribe VPN (), published by a Gmail account rather than Windscribe Limited. It routes ALL browser traffic through an attacker-controlled proxy at (:10,:26-48), which is completely unaffiliated with the real Windscribe. The privacy policy URLs point to throwaway paste sites ( and the latter referencing yet another VPN brand 'Touch VPN'), confirming no legitimate company identity. The ML score, third-party risk signals, and the 12% malware rate in the proxy+storage permhash cluster all corroborate this verdict.