Loading story…
A study has revealed that numerous VPN apps on Google Play, with over 700 million downloads, share hidden ownership and insecure cryptographic credentials. Many of these apps use hard-coded Shadowsocks passwords and deprecated ciphers, making user traffic vulnerable to decryption. The reuse of insecure components and disguised provider identities puts large user bases at risk, even if only one app in a family is compromised.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
3 references tracked. Mallory keeps watching after this page renders.
zimperium.com
Open sourcethehackernews.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An academic study of 281 popular free Android VPN apps on Google Play found widespread privacy and security failures affecting apps with more than 2.4 billion installs. Researchers from the University of Michigan, the University of New Mexico, and IIT Delhi used the **MVPNalyzer** framework to identify traffic escaping VPN tunnels, plaintext transmission of sensitive data, weak or missing encryption, and extensive contact with advertising and tracking services. The study reported 61 apps with unencrypted data flows, 29 with traffic leakage issues, and 246 that communicated with ad or tracking URLs. The most severe finding affected five apps that downloaded VPN configuration files without encryption, creating a path for an attacker on the same network to hijack the tunnel and redirect users to attacker-controlled VPN servers. Researchers also found weak OpenVPN configuration practices in 107 of 108 apps containing configuration files and said many apps showed poor resistance to censorship or VPN detection. Presented at **NDSS 2026**, the research argued that Google Play trust signals, including safety labels and the VPN "Verified" badge, do not reliably reflect the actual security of Android VPN apps.
Jul 15, 2026
Research into 18 popular free Android VPN apps on the Google Play Store found that most of them weakened user privacy instead of protecting it. Using static analysis with MobSF, researchers reported that 17 of the 18 apps contained at least one embedded tracker, averaging nearly five trackers per app, while many also requested permissions far beyond what a VPN typically needs, including access to sensitive device features such as the camera, microphone, and location. The findings flagged apps including **FreeVPN**, **VPN Proxy Master**, **Turbo VPN**, **VPN 360**, and **Secure VPN** as particularly concerning because they combined extensive tracking, dangerous permissions, and hardcoded connections to infrastructure in jurisdictions such as **China** and **Russia**. Researchers said many of the services appear to operate more like data collection and advertising platforms than genuine privacy tools, exposing users to surveillance and other security risks and reinforcing advice to scrutinize app permissions and favor more transparent alternatives.
Jun 29, 2026
A comprehensive analysis of mobile device security has revealed significant risks associated with both mobile VPN applications and pre-installed apps on low-cost Android devices. Zimperium zLabs conducted a large-scale study of 800 free VPN apps available for Android and iOS, uncovering that many of these applications fail to provide genuine privacy protections. Some VPN apps request permissions that are excessive for their intended function, potentially exposing users to unnecessary risks. The research found that several VPN apps leak personal data, undermining the very privacy they are supposed to protect. Outdated and vulnerable code was also identified in a number of these apps, increasing the attack surface for malicious actors. For organizations with bring-your-own-device (BYOD) policies, the use of insecure VPN apps by employees can introduce enterprise-level risks, as sensitive business data may be exposed through these weak points. The study highlights that even popular VPN apps are not immune to these issues, making it critical for both consumers and enterprises to scrutinize the security posture of mobile VPN solutions. In parallel, another research effort focused on the security of low-cost Android devices, particularly those running Android Go Edition in the African market. Researchers developed an automated framework, PiPLAnD, to extract and analyze APK files from physical devices, revealing that many pre-installed apps on these devices have high-level system access. Unlike apps distributed through the Google Play Store, these pre-installed applications often bypass rigorous security checks, making them potential vectors for malware and privacy violations. The study found that approximately 9% of the pre-installed apps analyzed were leaking sensitive user data, including location, device identifiers, and subscriber information. Data leaks occurred through various mechanisms such as SharedPreferences, device logs, Intents, and network transmissions. Some pre-installed apps were also found to have the capability to silently install additional applications without user consent, further compounding the security risk. In total, 33 apps exhibited this silent installation behavior, which could be exploited to introduce further malicious software onto the device. Both studies underscore the pervasive nature of mobile security threats, whether originating from third-party VPN apps or manufacturer-installed software on budget devices. The findings highlight the need for organizations to implement robust mobile device management policies and for users to exercise caution when selecting both devices and applications. The risks identified are not limited to individual privacy but extend to organizational security, especially in environments where personal devices are used for work purposes. The research calls attention to the importance of regular security assessments, updates, and the use of trusted sources for both hardware and software. Ultimately, the mobile ecosystem remains a complex and often under-scrutinized component of the broader cybersecurity landscape, requiring ongoing vigilance from both users and enterprises.
Jun 29, 2026