Socket Weekly: 737 Fake VPN Extensions, NIST Bets on AI, Private…

socket.dev · newsletter

Explore this email design and adapt it to your own brand. Review the copy, links, and offer before sending.

Email content

socket-weekly-new-header

Welcome to Socket Weekly. Each week, we share a short, opinionated snapshot of the most important security issues and ecosystem changes.

TOP STORY

737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection

Socket's research team traced 737 free Chrome VPN extensions to a single operator, many posing as brands like Proton and NordVPN, all routing a user's full browser session through the operator's own proxies. Most target Russian speakers trying to reach blocked services, the people with the most to lose if that traffic is watched. The same operator sells a paid VPN service in Russia, and the free extensions funnel users toward it.

MORE NEWS

NIST Proposes AI-Enabled NVD Overhaul After Cutting Routine CVE Enrichment

NIST is asking the security community how AI should reshape the National Vulnerability Database, and has begun building a tool called V-etalon to enrich vulnerability data. The move follows NIST's decision earlier this year to stop routinely enriching most CVEs, which left the majority of new records without severity scores or affected-version data.

White House Authorizes Private Companies to Conduct Offensive Cyber Operations

A new presidential memorandum lets vetted U.S. security firms hack, surveil, and disrupt foreign cybercrime groups under government contract, going well beyond the malware analysis and attribution work they already do for law enforcement. Every operation needs written DOJ or DHS approval, though critics note the same firms would identify the threats, propose the operations, and get paid to carry them out.

Never let a signup go cold again.

Turn emails into revenue with Brew. No credit card, free credits to try.