Socket.dev Fake VPN Extension Campaign Network IOC

F S@Fsdr

•updated Aug 19, 2026•20•1•28

This rule monitors network connections for traffic directed towards domains and IP addresses associated with a known malicious campaign distributing fake VPN browser extensions, as identified by Socket.dev. These domains and IPs are used for command and control or malicious communication by the browser extensions.