Google is raising the alarm about a “dramatic” increase in the number of rogue virtual private network (VPN) products on its Android app store, which it says can monitor all your internet traffic and deliver malware.
This is an ironic turn of events since VPNs are supposed to protect your privacy by keeping your internet connection secure. But Google’s analysis suggests that at least 1% of so-called VPN apps are guilty of doing the opposite. And this may be a conservative estimate.
In a new warning, the company advises people to remain on official app stores, think hard about permissions and exercise extreme caution over “too good to be true” free offers.
What Google Says Is at Risk from Rogue Android VPNs
Malicious actors, who are, according to Google’s advisory, packaging data-harvesting code within apps posing as VPNs, promise downloaders anonymity and unlimited bandwidth. After installation, the apps are able to intercept network traffic as well as other sensitive information such as an identifier that can be used to track users and tie back to potentially personally identifiable information, along with requesting elevated device permissions, which are not needed for a virtual private network. Google did not cite any particular titles, but it stressed some basic hygiene: downloading only from official stores, checking to see whether the VPN offers a badge in Google Play (a helpful authenticity certification), avoiding sideloading unknown APKs and being skeptical of free, unlimited plans.
The firm also points out that a VPN should never need access to contacts, private messages, call logs or SMS. No one should ever click past a warning from the browser, and antivirus software should never be turned off. This is also the case with good VPNs on Android, which use the platform’s VPNService API to function and don’t require unsolicited access to private information or control over your device.
Why Rogue VPNs Work So Well to Evade User Trust
VPNs occupy a precarious position in your digital life: They can see where your traffic is headed even if they can’t read the actual data passing over their network, thanks to end-to-end encryption. That visibility makes them desirable targets for fraudsters. During peak shopping and travel seasons downloads multiply for privacy apps, prompting copycat brands, lookalike icons and outright fakes that promise “turbo” VPNs — or virtual private network providers — with the single tap of a button. The vast majority are companies you’ve never heard of, have dodgy addresses in unfamiliar locations and nearly unlimited access to your personal data.
A number of studies from academic teams and independent labs have shown that a large proportion of free VPNs either collect your data overmuch, or include third-party trackers — or feature weak SSL encryption. (Nefarious VPNs have been documented to employ aggressive permission requests or certificate tricks to keep an eye on users, according to security groups like Citizen Lab and ESET.) In other words, “VPN” means nothing in terms of privacy; everything depends on operator practices and the quality of its code.
How to Check Out a VPN Before Installing It
Start inside Google Play. Prefer apps that have the VPN badge or, where applicable, the Independent security review badge of the App Defense Alliance with Google Play Protect. Read the section about Data Safety and verify that the dev’s name, company website and support channels are coherent and transparent.
Scrutinize permissions. It should also raise red flags if that includes contacts, SMS, call logs, photos, your precise location or the ability to access notifications and use accessibility services. These are not necessary for a VPN client to tunnel traffic. Be suspicious of invitations to install custom root certificates, or fiddle with security settings — legitimate consumer VPNs should never require that kind of function on Android.
Check the trust story. Search for separate security audits (such as through firms like Cure53 or Deloitte), a visible no-logs policy, named and known leadership and privacy terms in plain English. Check reputable security reporting of previous issues. Steer clear of apps with generic developer names, copy-pasted descriptions or an influx of suspiciously similar five-star reviews.
What Android Does Already, and Its Limits
Google Play Protect constantly scans installed apps for malware and policy violations, while Google regularly announces that it has blocked vast numbers of potentially harmful submissions. Still, attackers iterate quickly. Sideloaded apps — which are installed outside of official stores — skirt many of those checks and represent an outsized risk. Even official stores can have new developer accounts emerge and vanish before they are taken down.
A sophisticated attacker is also likely to misuse valid APIs, covering up malicious activities with delay triggers or server-side switches. That makes user caution and permission consciousness as important as store vetting.
If You Installed a Shady VPN Already, Do This
Act quickly. Disconnect and delete the app, also reviewing device permissions to revoke anything the VPN may have granted itself. Delete VPN profiles that you don’t know and certificates that are new to you. Perform a full device scan using a trusted mobile security tool and review your Google account for any unauthorized sign-ins.
Rotate your passwords, turn on multi-factor authentication and keep an eye on financial accounts for anything out of the ordinary. If this is a work device, report it to your IT team right away. For the highest-risk cases, consider performing a factory reset and restoring from a clean backup.
The Bigger Picture on Cybercrime and VPN Impersonation
The broader threat environment continues to develop: According to the FBI’s Internet Crime Complaint Center, there have been year-over-year increases in cybercrime losses that hit all-time highs, and criminal organizations are increasingly relying on mobile distribution to grow their businesses. VPN brand impersonation is merely the latest chapter of an age-old propaganda war — abuse the shield of privacy to hoover up that very thing which users hope it will protect.
Google’s message is simple: think of VPNs the way you might think of a bank app. Select a successful service and check the listing. Ask about every single permission. Privacy tools should collect as little from you as possible, not profit from what you share.