--- title: "Urban VPN Proxy extension collects user data! | Phish Protection" description: "Urban VPN Proxy extension collects user data! https://media.mailhop.org/phishprotection/images/2025/12/Urban-VPN-Proxy-extension-collects-user-data." image: "https://phishprotection.com/og/blog/urban-vpn-proxy-extension-collects-user-data.png" canonical: "https://phishprotection.com/blog/urban-vpn-proxy-extension-collects-user-data/" --- Quick Answer by Phishing Protection https://media.mailhop.org/phishprotection/images/2025/12/Urban-VPN-Proxy-extension-collects-user-data.mp3 If you have been using the Urban VPN Proxy for privacy, you must see this! This browser extension actually harvests user data to facilitate the easy sale of the same. Urban VPN Proxy is used as an Edge and Chrome extension and has received an impeccable rating of 4.7 on the Google Web Store . Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fphishprotection.com%2Fblog%2Furban-vpn-proxy-extension-collects-user-data%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Urban%20VPN%20Proxy%20extension%20collects%20user%20data!&url=https%3A%2F%2Fphishprotection.com%2Fblog%2Furban-vpn-proxy-extension-collects-user-data%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fphishprotection.com%2Fblog%2Furban-vpn-proxy-extension-collects-user-data%2F "Share on Facebook") [ ](https://reddit.com/submit?url=https%3A%2F%2Fphishprotection.com%2Fblog%2Furban-vpn-proxy-extension-collects-user-data%2F&title=Urban%20VPN%20Proxy%20extension%20collects%20user%20data! "Share on Reddit") [ ](mailto:?subject=Urban%20VPN%20Proxy%20extension%20collects%20user%20data!&body=Check out this article: https%3A%2F%2Fphishprotection.com%2Fblog%2Furban-vpn-proxy-extension-collects-user-data%2F "Share via Email") ![Phish Protection blog post image](https://media.mailhop.org/phishprotection/images/2025/12/vpn-security.jpg) ##### Urban VPN Proxy extension collects user data! by **Phishing Protection** ``` ``` If you have been using the Urban VPN Proxy for privacy, you must see this! This browser extension actually harvests **user data** to facilitate the easy sale of the same. **Urban VPN Proxy** is used as an Edge and[Chrome extension](/content/anti-phishing/anti-phishing-chrome-extension)and has received an impeccable rating of 4.7 on the Google Web Store . It also has a “featured” badge from Google. This means that Urban VPN Proxy has easily passed manual review and also caters to the standards set by Google. However, a group of researchers at Koi Security has discovered that this extension has been harvesting user data from[8 commonly used AI chatbots](https://www.koi.ai/blog/urban-vpn-browser-extension-ai-conversations-data-collection) - Gemini, ChatGPT, Perplexity, **Microsoft Copilot**, Claude, Meta AI, Grok, and DeepSeek. ![Vpn security](https://media.mailhop.org/phishprotection/images/2025/12/vpn-security.jpg) Idan Dardikman, the Chief Technology Officer and Co-founder at **Koi Security**, has stated that the extension continues to collect data in the background, whether it is currently connected or not. What’s worse is that this extension lacks a user-facing toggle so that users can disable it. As of now, the only way to prevent the extension from collecting your data is to uninstall it right away. Dardikman believes this **data-collection** feature has affected a whopping[8 million users.](https://www.darkreading.com/endpoint-security/chrome-extension-harvests-ai-chatbot-data) The 5.5.0 Version of Urban VPN Proxy has the data harvesting feature enabled. All other versions prior to this one did not collect any **user data**. The publisher of Urban VPN Proxy has multiple other extensions, which the researchers believe are also involved in data harvesting. These extensions include **Urban Ad Blocker**, Urban Browser Guard,[1ClickVPN Proxy](https://www.1clickvpn.com/), etc. ![ChatAI bots](https://media.mailhop.org/phishprotection/images/2025/12/chatAI-bots.jpg) ### **How is Urban VPN Proxy collecting your data?** The extension uses a tailored JavaScript executor. Whenever you use a **targeted AI chatbot**, it gets triggered to collect user data. Basically, the extension keeps track of your browser tabs and injects the executor JavaScript into the page you’re visiting. Once the[malicious script](https://www.trendmicro.com/vinfo/pl/security/news/cybercrime-and-digital-threats/malicious-script-plagues-over-2-000-wordpress-accounts-redirects-visitors-to-scam-sites)is injected, it acquires control over two main functions: fetch and XMLHttpRequest. These functions handle most of the requests a browser receives or **sends to the internet**. So, by overriding these two functions, the Urban VPN Proxy effectively positions itself at the center, with all other network activities revolving around it. In simple words, all the requests that you make to your[ChatBot](/phishing/how-chatbots-becomne-a-phishing-tool), and the responses that you receive, have to go through the code of the extension first. Now, this gives complete visibility into the data being sent and received, well before the **browser processes** or even displays it. ![Phishpr info](https://media.mailhop.org/phishprotection/images/2025/12/phishpr-info.jpg) So, when you enter a prompt into an AI chatbot or maybe receive a reply to your question, Urban VPN Proxy can easily view the **raw API traffic** in the background. The worst part is that this interception stays invisible to the unsuspecting user. The extension is more like an invisible middleman between the[AI chatbot](https://www.ftc.gov/news-events/news/press-releases/2025/09/ftc-launches-inquiry-ai-chatbots-acting-companions)and the user. The injected script can easily scan all the intercepted data and extract all your conversation data . The extracted data may include the prompts you used, timestamps, **chatbot replies**, interaction metadata, and session identifiers. Just imagine how detailed a picture this extension can develop around your behaviour, interests, and other sensitive conversations. ### **What happens to the collected data?** The[harvested data](https://www.infosecurity-magazine.com/news/urban-vpn-proxy-harvesting-ai-chats/)is sent to the extension’s **background service** worker. Next, the same data is compressed and transmitted to Urban VPN Proxy’s servers. All these keep happening discreetly in the background, and the user receives no notification. ![Cyber security](https://media.mailhop.org/phishprotection/images/2025/12/cyber-security.jpg) Urban VPN Proxy has been developed by Urban[Cyber Security](/content/cybersecurity-in-a-nutshell)Inc., which is well-connected to BiScience. The latter has the reputation of being a **data broker**. In the past, researchers have found out that BiScience was involved in collecting a large amount of clickstream and browsing data and linking the same to persistent device identifiers. This makes it possible to re-identify individual users. BiScience also offers Software Development Kits to other **extension developers**, enabling them to harvest and monetize user data. Further, BiScience actively[sells user data](https://www.malwarebytes.com/blog/news/2025/07/startup-takes-personal-data-stolen-by-malware-and-sells-it-on-to-other-companies)through products like ClickStream OS and AdClarity. ### **Why is it concerning for users?** It is true that Urban VPN mentions a certain degree of AI data processing during installation. But what happens in the background stays hidden in the lengthy and jargon-infested **privacy documents**. ![Vpn proxy](https://media.mailhop.org/phishprotection/images/2025/12/vpn-proxy.jpg) This extension is directly creating trust issues. Rather than offering protection,[Urban VPN Proxy](https://thehackernews.com/2025/12/featured-chrome-browser-extension.html)is acting as a surveillance tool. Given that users share personal, professional, and **confidential data** with chatbots, Urban’s data harvesting seems way too intrusive. The extension poses a threat to both individual users and organizations. It’s best to avoid using free VPNs, as they are far more likely to collect and monetize your personal data instead of charging a fee. Carefully reviewing permission requests during installation can help you spot data-harvesting red flags, while enabling strong[phishing protection](/)adds an extra layer of defense against **malicious websites** and online scams . ## Topics [ Phishing ](/tags/phishing/) ![Brad Slavin](https://media.mailhop.org/phishprotection/images/authors/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager Founder and General Manager of DuoCircle. Product strategy and commercial lead across DuoCircle's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Protect your inbox from phishing attacks Real-time email security with 60-day free trial. No credit card required. [Start Free Trial](https://portal.duocircle.com/cart.php?a=add&pid=101&brand=phishprotection) [View Pricing](/pricing/) ## Related Articles [ Foundational 5m 0ktapus, Okta Breach Helps Attackers Launch Sophisticated Supply Chain Attacks Sep 5, 2022 ](/blog/0ktapus-okta-breach-helps-attackers-launch-sophisticated-supply-chain-attacks/)[ Foundational 4m 13 Spear Phishing Attacks Examples To Justify Investment For Phishing Prevention Solutions In Your Organization Aug 1, 2019 ](/blog/13-spear-phishing-attacks-examples-to-justify-investment-for-phishing-prevention-solutions-in-your-organization/)[ Foundational 4m All 14 centers of Kettering Health were affected by a massive ransomware attack, Major outage in the Ohio medical center May 23, 2025 ](/blog/14-centers-of-kettering-health-were-affected-by-massive-ransomware-attack-in-ohio-medical-center/)[ Foundational 4m 2021 Phishing Trends You Need To Be Wary Of Aug 2, 2021 ](/blog/2021-phishing-trends-to-be-wary-of/) ```json {"@context":"https://schema.org","@type":"Organization","name":"Phish Protection","url":"https://phishprotection.com","logo":{"@type":"ImageObject","url":"https://phishprotection.com/images/phishprotection-logo.png"},"description":"Advanced phishing protection and email security for businesses. Real-time threat defense, time-of-click protection, and seamless Office 365 integration.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://github.com/duocircle"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://phishprotection.com/contact/"},"knowsAbout":["Phishing Protection","Email Security","Anti-Phishing","Business Email Compromise","Ransomware Protection","Time of Click Protection","Office 365 Email Security","Advanced Threat Defense"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"Phish Protection","url":"https://phishprotection.com","description":"Advanced phishing protection and email security for businesses. Real-time threat defense, time-of-click protection, and seamless Office 365 integration.","publisher":{"@type":"Organization","name":"Phish Protection","url":"https://phishprotection.com","logo":{"@type":"ImageObject","url":"https://phishprotection.com/images/phishprotection-logo.png"},"description":"Advanced phishing protection and email security for businesses. Real-time threat defense, time-of-click protection, and seamless Office 365 integration.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"Urban VPN Proxy extension collects user data!","description":"Urban VPN Proxy extension collects user data! https://media.mailhop.org/phishprotection/images/2025/12/Urban-VPN-Proxy-extension-collects-user-data.","url":"https://phishprotection.com/blog/urban-vpn-proxy-extension-collects-user-data/","datePublished":"2025-12-19T11:08:07.000Z","dateModified":"2026-04-17T16:29:18.000Z","dateCreated":"2025-12-19T11:08:07.000Z","author":{"@type":"Person","@id":"https://phishprotection.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://phishprotection.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. He founded DuoCircle in 2014 and has led the company's growth to 2,000+ customers across its email security product family. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/phishprotection/images/authors/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"Phish Protection","url":"https://phishprotection.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"Phish Protection","url":"https://phishprotection.com","logo":{"@type":"ImageObject","url":"https://phishprotection.com/images/phishprotection-logo.png"},"description":"Advanced phishing protection and email security for businesses. Real-time threat defense, time-of-click protection, and seamless Office 365 integration.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://github.com/duocircle"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://phishprotection.com/contact/"},"knowsAbout":["Phishing Protection","Email Security","Anti-Phishing","Business Email Compromise","Ransomware Protection","Time of Click Protection","Office 365 Email Security","Advanced Threat Defense"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://phishprotection.com/blog/urban-vpn-proxy-extension-collects-user-data/"},"articleSection":"foundational","keywords":"Phishing","wordCount":877,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/phishprotection/images/2025/12/vpn-security.jpg","caption":"Phish Protection blog post image","width":1200,"height":630},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://phishprotection.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://phishprotection.com/blog/"},{"@type":"ListItem","position":3,"name":"Foundational","item":"https://phishprotection.com/foundational/"},{"@type":"ListItem","position":4,"name":"Urban VPN Proxy extension collects user data!","item":"https://phishprotection.com/blog/urban-vpn-proxy-extension-collects-user-data/"}]} ```