What can I do if I was affected by the Chrome spyware extension?

🛠 How the Spyware Worked

• Originally a real VPN, FreeVPN.One became spyware after updates in April 2025 added broad permissions.
• It silently captured screenshots of everything you viewed including  banking, work docs, personal chats and sent them to remote servers.
• Over 100,000 users trusted it because it had a verified Chrome badge and was featured on the Web Store.
• Used injected scripts to capture sensitive information without consent.

🔒 If You Still Have Access to Your Accounts

1. Remove the Extension Immediately: Go to chrome://extensions → Find FreeVPN.One → Click Remove.

2. Scan Your Computer: Run a full antivirus/anti-malware scan to ensure no additional spyware remains.

3. Change All Important Passwords: Update email, banking, work, and social media passwords. Use strong, unique passwords.

4. Enable Two-Factor Authentication (2FA): Prefer app-based authentication (Google Authenticator, Authy, etc.) over SMS.

5. Check Account Security Logs: Review recent login activity and revoke unfamiliar sessions.

6. Monitor Financial & Personal Accounts: Watch for unauthorized transactions or login attempts.

🚫 If Sensitive Accounts May Be Compromised

• Notify Banks/Workplace, If financial or company data was accessed.
• Freeze or Replace Cards, If banking credentials may have been exposed.
• Log Out of All Sessions and force-refresh logins across devices.

🔁 Ongoing Protection

• Audit browser extensions regularly and remove ones you don’t use.
• Avoid free or unverified VPN/browser security tools.
• Keep Chrome, OS, and antivirus updated.
• Use a password manager to create and store strong passwords.
• Stick to trusted VPN providers (ProtonVPN, NordVPN etc.).

⚠️ Report the Incident

• Google: Report malicious extensions → Chrome Web Store Help.
• Cybercrime Agencies:
  • U.S.: FBI IC3 → ic3.gov
  • UK: Action Fraud → actionfraud.police.uk
  • India: CERT-In portal → cert-in.org.in
  • EU/Global: Report to your national CERT.

• FTC (U.S.): If financial or identity theft is suspected → reportfraud.ftc.gov
• Local Police: If extortion, fraud, or financial loss occurs.
• 911cyber.app: Get immediate cybersecurity help.

✅ Bottom Line

The FreeVPN.One case proves that even “verified” extensions can turn malicious. If you installed it, remove it now, secure your accounts, scan your devices, and report the incident. Going forward, limit extensions, use trusted VPNs, and enforce strong password and authentication practices.