Loading story…
An academic study of 281 popular free Android VPN apps on Google Play found widespread privacy and security failures affecting apps with more than 2.4 billion installs. Researchers from the University of Michigan, the University of New Mexico, and IIT Delhi used the MVPNalyzer framework to identify traffic escaping VPN tunnels, plaintext transmission of sensitive data, weak or missing encryption, and extensive contact with advertising and tracking services. The study reported 61 apps with unencrypted data flows, 29 with traffic leakage issues, and 246 that communicated with ad or tracking URLs.
The most severe finding affected five apps that downloaded VPN configuration files without encryption, creating a path for an attacker on the same network to hijack the tunnel and redirect users to attacker-controlled VPN servers. Researchers also found weak OpenVPN configuration practices in 107 of 108 apps containing configuration files and said many apps showed poor resistance to censorship or VPN detection. Presented at NDSS 2026, the research argued that Google Play trust signals, including safety labels and the VPN "Verified" badge, do not reliably reflect the actual security of Android VPN apps.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Researchers from the University of Michigan, the University of New Mexico, and IIT Delhi presented the study and its findings at NDSS 2026. They also argued that Google Play trust signals such as safety labels and the VPN "Verified" badge do not reliably indicate actual app security.
The most severe issue affected five apps that fetched configuration files without encryption, allowing an attacker on the same network to redirect users to attacker-controlled VPN servers. The study also found weak OpenVPN configuration practices in 107 of 108 apps containing configuration files.
The study found broad security and privacy failures across the tested apps, including traffic leaking outside VPN tunnels, plaintext transmission of sensitive data, weak or absent encryption, and extensive contact with advertising or tracking services. Reported counts included 61 apps with unencrypted data flows, 29 with traffic leakage issues, and 246 contacting ad or tracking URLs.
A 2026 academic study used the MVPNalyzer framework to systematically test 281 popular free Android VPN apps from the Google Play Store for privacy and security weaknesses. The researchers described MVPNalyzer as the first framework for systematic, repeatable auditing of Android VPN apps.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Research into 18 popular free Android VPN apps on the Google Play Store found that most of them weakened user privacy instead of protecting it. Using static analysis with MobSF, researchers reported that 17 of the 18 apps contained at least one embedded tracker, averaging nearly five trackers per app, while many also requested permissions far beyond what a VPN typically needs, including access to sensitive device features such as the camera, microphone, and location. The findings flagged apps including **FreeVPN**, **VPN Proxy Master**, **Turbo VPN**, **VPN 360**, and **Secure VPN** as particularly concerning because they combined extensive tracking, dangerous permissions, and hardcoded connections to infrastructure in jurisdictions such as **China** and **Russia**. Researchers said many of the services appear to operate more like data collection and advertising platforms than genuine privacy tools, exposing users to surveillance and other security risks and reinforcing advice to scrutinize app permissions and favor more transparent alternatives.
Jun 29, 2026
Researchers reported that malicious Android applications, including VPN-themed apps and software built with the **LumiApps** SDK, secretly enrolled users’ devices into a proxy network and routed third-party traffic through them without informed consent. HUMAN’s Satori team said the operation, tracked as **PROXYLIB**, used a Golang-based native library, `libgojni.so`, to contact command-and-control servers, register infected phones, and maintain persistent proxy connections through Android services and boot receivers. The activity was linked to earlier infections found in **Oko VPN** and 28 related Google Play apps, as well as a later variant that could be embedded during app development or injected into APKs without source-code access. Investigators said the infrastructure and monetization appeared tied to **Asocks**, a residential proxy service, indicating the compromised devices were likely being sold as proxy exit nodes for cybercriminal use. Google removed the identified apps from Google Play, and **Google Play Protect** now detects or blocks known PROXYLIB-related applications, while researchers warned the operators are likely to keep shifting to third-party app stores and modified APK distribution.
Jun 29, 2026
Researchers have uncovered significant security and privacy issues in Android mobile applications, particularly those in the healthcare sector. A comprehensive study analyzed 272 healthcare-related Android apps, revealing that many transmit sensitive user data without encryption, store files insecurely, or share information with third-party components without adequate safeguards. The research team employed multiple static analysis tools, including MobSF, RiskInDroid, and OWASP Mobile Audit, to assess the security posture of these apps. MobSF identified weaknesses in permissions, network handling, certificate management, and manifest configuration, with app security scores ranging from 35 to 60 out of 100. RiskInDroid found that 150 apps used undeclared permissions, potentially creating hidden channels for data exfiltration, and flagged proprietary permissions that could bypass standard Android security controls. The OWASP Mobile Audit of 95 apps detected issues such as unencrypted local storage, hardcoded credentials, and missing input validation, mapping these weaknesses to the OWASP Mobile Top 10 categories. In parallel, researchers have demonstrated that some Android apps can bypass operating system permissions to access sensitive data through hidden methods and side-channel attacks. One such attack, dubbed 'Pixnapping' and tracked as CVE-2025-48561, allows a malicious app to capture screen display pixels, potentially exposing sensitive information like two-factor authentication codes. The Pixnapping attack was demonstrated on multiple devices, including Google Pixel 6 through 9 and Samsung Galaxy S25, and is conceptually similar to a 12-year-old browser-based data-stealing technique. Despite previous attempts by Google to address this vulnerability, researchers showed that the flaw remains exploitable on Android versions 13 to 16. The ability of apps to sidestep permissions and leverage hardware side channels raises serious concerns about the effectiveness of current Android security controls. These findings highlight the urgent need for stronger app vetting processes, improved permission management, and enhanced user awareness regarding the risks of installing mobile applications. The exposure of sensitive healthcare data is particularly alarming, given the potential for identity theft, fraud, and privacy violations. Security experts recommend that users exercise caution when granting permissions to apps and that developers adhere to best practices for secure coding and data protection. The research underscores the importance of regular security assessments and updates to address emerging threats in the mobile ecosystem. Industry standards such as the OWASP Mobile Top 10 provide a useful framework for identifying and mitigating common vulnerabilities. The ongoing discovery of new attack vectors, such as Pixnapping, demonstrates that attackers continue to innovate, necessitating a proactive and layered approach to mobile security. Organizations handling sensitive data, especially in healthcare, must prioritize mobile app security to protect user privacy and comply with regulatory requirements. The convergence of insecure app design and advanced attack techniques poses a growing threat to the confidentiality and integrity of user data on Android devices.
Jun 29, 2026