Loading story…
Research into 18 popular free Android VPN apps on the Google Play Store found that most of them weakened user privacy instead of protecting it. Using static analysis with MobSF, researchers reported that 17 of the 18 apps contained at least one embedded tracker, averaging nearly five trackers per app, while many also requested permissions far beyond what a VPN typically needs, including access to sensitive device features such as the camera, microphone, and location.
The findings flagged apps including FreeVPN, VPN Proxy Master, Turbo VPN, VPN 360, and Secure VPN as particularly concerning because they combined extensive tracking, dangerous permissions, and hardcoded connections to infrastructure in jurisdictions such as China and Russia. Researchers said many of the services appear to operate more like data collection and advertising platforms than genuine privacy tools, exposing users to surveillance and other security risks and reinforcing advice to scrutinize app permissions and favor more transparent alternatives.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers reported that several apps used hardcoded connections to servers in jurisdictions such as China and Russia, raising surveillance and privacy concerns. The report concluded that many free VPNs operate more as data collection and advertising platforms than genuine privacy tools.
The analysis found that 17 of 18 apps contained at least one tracker, averaging nearly five trackers per app, and that several requested permissions beyond what a VPN typically needs, including access to sensitive device features. Apps including FreeVPN, VPN Proxy Master, Turbo VPN, VPN 360, and Secure VPN were highlighted as especially concerning.
Mysterium VPN conducted a static analysis of 18 popular free Android VPN apps from the Google Play Store using MobSF to assess their privacy and security behavior. The study examined embedded trackers, requested permissions, and hardcoded network infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An academic study of 281 popular free Android VPN apps on Google Play found widespread privacy and security failures affecting apps with more than 2.4 billion installs. Researchers from the University of Michigan, the University of New Mexico, and IIT Delhi used the **MVPNalyzer** framework to identify traffic escaping VPN tunnels, plaintext transmission of sensitive data, weak or missing encryption, and extensive contact with advertising and tracking services. The study reported 61 apps with unencrypted data flows, 29 with traffic leakage issues, and 246 that communicated with ad or tracking URLs. The most severe finding affected five apps that downloaded VPN configuration files without encryption, creating a path for an attacker on the same network to hijack the tunnel and redirect users to attacker-controlled VPN servers. Researchers also found weak OpenVPN configuration practices in 107 of 108 apps containing configuration files and said many apps showed poor resistance to censorship or VPN detection. Presented at **NDSS 2026**, the research argued that Google Play trust signals, including safety labels and the VPN "Verified" badge, do not reliably reflect the actual security of Android VPN apps.
Jul 11, 2026
Researchers reported that malicious Android applications, including VPN-themed apps and software built with the **LumiApps** SDK, secretly enrolled users’ devices into a proxy network and routed third-party traffic through them without informed consent. HUMAN’s Satori team said the operation, tracked as **PROXYLIB**, used a Golang-based native library, `libgojni.so`, to contact command-and-control servers, register infected phones, and maintain persistent proxy connections through Android services and boot receivers. The activity was linked to earlier infections found in **Oko VPN** and 28 related Google Play apps, as well as a later variant that could be embedded during app development or injected into APKs without source-code access. Investigators said the infrastructure and monetization appeared tied to **Asocks**, a residential proxy service, indicating the compromised devices were likely being sold as proxy exit nodes for cybercriminal use. Google removed the identified apps from Google Play, and **Google Play Protect** now detects or blocks known PROXYLIB-related applications, while researchers warned the operators are likely to keep shifting to third-party app stores and modified APK distribution.
Jun 29, 2026
A coalition of agencies from the U.K., Australia, Canada, Germany, New Zealand, and the United States published advisories identifying the mobile spyware families **BadBazaar** and **Moonshine** in dozens of legitimate-looking apps. The malware was disguised as Android prayer apps, messaging tools, PDF readers, and utility apps, and one iOS app, **`TibetOne`**, was also named. Officials said the spyware targeted civil society groups and people connected to issues viewed by the Chinese state as sensitive, including Uyghur, Tibetan, Taiwanese, Hong Kong democracy, and Falun Gong communities. Technical analysis from the Australian Cyber Security Centre said **Moonshine** was distributed through trojanized apps, social media, messaging platforms, and in some cases official app stores, while **BadBazaar** included Android and iOS variants such as **BadSolar** and **BadSignal**. The spyware can collect files, chats, photos, location data, audio, and device information, giving operators broad surveillance access to cameras and microphones. Investigators also reported infrastructure overlaps tied to social-engineering assets, reused registration details, SSL certificate artifacts, and activity previously associated with **TA413**, **APT5**, **APT14**, and infrastructure linked to **UPSEC**.
Jun 29, 2026