Loading story…
A comprehensive analysis of mobile device security has revealed significant risks associated with both mobile VPN applications and pre-installed apps on low-cost Android devices. Zimperium zLabs conducted a large-scale study of 800 free VPN apps available for Android and iOS, uncovering that many of these applications fail to provide genuine privacy protections. Some VPN apps request permissions that are excessive for their intended function, potentially exposing users to unnecessary risks. The research found that several VPN apps leak personal data, undermining the very privacy they are supposed to protect. Outdated and vulnerable code was also identified in a number of these apps, increasing the attack surface for malicious actors. For organizations with bring-your-own-device (BYOD) policies, the use of insecure VPN apps by employees can introduce enterprise-level risks, as sensitive business data may be exposed through these weak points. The study highlights that even popular VPN apps are not immune to these issues, making it critical for both consumers and enterprises to scrutinize the security posture of mobile VPN solutions.
In parallel, another research effort focused on the security of low-cost Android devices, particularly those running Android Go Edition in the African market. Researchers developed an automated framework, PiPLAnD, to extract and analyze APK files from physical devices, revealing that many pre-installed apps on these devices have high-level system access. Unlike apps distributed through the Google Play Store, these pre-installed applications often bypass rigorous security checks, making them potential vectors for malware and privacy violations. The study found that approximately 9% of the pre-installed apps analyzed were leaking sensitive user data, including location, device identifiers, and subscriber information. Data leaks occurred through various mechanisms such as SharedPreferences, device logs, Intents, and network transmissions. Some pre-installed apps were also found to have the capability to silently install additional applications without user consent, further compounding the security risk. In total, 33 apps exhibited this silent installation behavior, which could be exploited to introduce further malicious software onto the device.
Both studies underscore the pervasive nature of mobile security threats, whether originating from third-party VPN apps or manufacturer-installed software on budget devices. The findings highlight the need for organizations to implement robust mobile device management policies and for users to exercise caution when selecting both devices and applications. The risks identified are not limited to individual privacy but extend to organizational security, especially in environments where personal devices are used for work purposes. The research calls attention to the importance of regular security assessments, updates, and the use of trusted sources for both hardware and software. Ultimately, the mobile ecosystem remains a complex and often under-scrutinized component of the broader cybersecurity landscape, requiring ongoing vigilance from both users and enterprises.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Following publication of the Zimperium research, multiple security news outlets highlighted the findings and warned that insecure free VPN apps could expose consumer and BYOD enterprise data. Coverage emphasized data leakage, surveillance risk, and weak privacy protections across both Android and iOS apps.
The researchers reported outdated and vulnerable components in multiple apps, including three using an OpenSSL version affected by Heartbleed and roughly 1% susceptible to man-in-the-middle attacks. They also found widespread permission abuse, such as requests for location, system logs, microphone, and screen-capture access, along with poor transparency in many iOS apps.
Zimperium zLabs conducted a study of nearly 800 free VPN apps for Android and iOS, examining their security, privacy, and permission practices. The research found many apps provided little real privacy benefit while introducing surveillance and security risks.
Researchers in the Free and Open Communications on the Internet initiative published a report on widely used free Android VPN apps, finding many were insecure and collectively had more than 700 million Google Play downloads. The study said most analyzed apps clustered into three groups ultimately owned by Qihoo 360 and identified privacy and security issues including location tracking, weak encryption, and hard-coded Shadowsocks passwords.
5 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcescworld.com
Open sourcezimperium.com
Open sourcehelpnetsecurity.com
Open sourcetechspot.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An academic study of 281 popular free Android VPN apps on Google Play found widespread privacy and security failures affecting apps with more than 2.4 billion installs. Researchers from the University of Michigan, the University of New Mexico, and IIT Delhi used the **MVPNalyzer** framework to identify traffic escaping VPN tunnels, plaintext transmission of sensitive data, weak or missing encryption, and extensive contact with advertising and tracking services. The study reported 61 apps with unencrypted data flows, 29 with traffic leakage issues, and 246 that communicated with ad or tracking URLs. The most severe finding affected five apps that downloaded VPN configuration files without encryption, creating a path for an attacker on the same network to hijack the tunnel and redirect users to attacker-controlled VPN servers. Researchers also found weak OpenVPN configuration practices in 107 of 108 apps containing configuration files and said many apps showed poor resistance to censorship or VPN detection. Presented at **NDSS 2026**, the research argued that Google Play trust signals, including safety labels and the VPN "Verified" badge, do not reliably reflect the actual security of Android VPN apps.
Jul 15, 2026
Researchers have uncovered significant security and privacy issues in Android mobile applications, particularly those in the healthcare sector. A comprehensive study analyzed 272 healthcare-related Android apps, revealing that many transmit sensitive user data without encryption, store files insecurely, or share information with third-party components without adequate safeguards. The research team employed multiple static analysis tools, including MobSF, RiskInDroid, and OWASP Mobile Audit, to assess the security posture of these apps. MobSF identified weaknesses in permissions, network handling, certificate management, and manifest configuration, with app security scores ranging from 35 to 60 out of 100. RiskInDroid found that 150 apps used undeclared permissions, potentially creating hidden channels for data exfiltration, and flagged proprietary permissions that could bypass standard Android security controls. The OWASP Mobile Audit of 95 apps detected issues such as unencrypted local storage, hardcoded credentials, and missing input validation, mapping these weaknesses to the OWASP Mobile Top 10 categories. In parallel, researchers have demonstrated that some Android apps can bypass operating system permissions to access sensitive data through hidden methods and side-channel attacks. One such attack, dubbed 'Pixnapping' and tracked as CVE-2025-48561, allows a malicious app to capture screen display pixels, potentially exposing sensitive information like two-factor authentication codes. The Pixnapping attack was demonstrated on multiple devices, including Google Pixel 6 through 9 and Samsung Galaxy S25, and is conceptually similar to a 12-year-old browser-based data-stealing technique. Despite previous attempts by Google to address this vulnerability, researchers showed that the flaw remains exploitable on Android versions 13 to 16. The ability of apps to sidestep permissions and leverage hardware side channels raises serious concerns about the effectiveness of current Android security controls. These findings highlight the urgent need for stronger app vetting processes, improved permission management, and enhanced user awareness regarding the risks of installing mobile applications. The exposure of sensitive healthcare data is particularly alarming, given the potential for identity theft, fraud, and privacy violations. Security experts recommend that users exercise caution when granting permissions to apps and that developers adhere to best practices for secure coding and data protection. The research underscores the importance of regular security assessments and updates to address emerging threats in the mobile ecosystem. Industry standards such as the OWASP Mobile Top 10 provide a useful framework for identifying and mitigating common vulnerabilities. The ongoing discovery of new attack vectors, such as Pixnapping, demonstrates that attackers continue to innovate, necessitating a proactive and layered approach to mobile security. Organizations handling sensitive data, especially in healthcare, must prioritize mobile app security to protect user privacy and comply with regulatory requirements. The convergence of insecure app design and advanced attack techniques poses a growing threat to the confidentiality and integrity of user data on Android devices.
Jun 29, 2026
Research into 18 popular free Android VPN apps on the Google Play Store found that most of them weakened user privacy instead of protecting it. Using static analysis with MobSF, researchers reported that 17 of the 18 apps contained at least one embedded tracker, averaging nearly five trackers per app, while many also requested permissions far beyond what a VPN typically needs, including access to sensitive device features such as the camera, microphone, and location. The findings flagged apps including **FreeVPN**, **VPN Proxy Master**, **Turbo VPN**, **VPN 360**, and **Secure VPN** as particularly concerning because they combined extensive tracking, dangerous permissions, and hardcoded connections to infrastructure in jurisdictions such as **China** and **Russia**. Researchers said many of the services appear to operate more like data collection and advertising platforms than genuine privacy tools, exposing users to surveillance and other security risks and reinforcing advice to scrutinize app permissions and favor more transparent alternatives.
Jun 29, 2026