- A Zimperium analysis reveals serious flaws in hundreds of free VPN apps for iOS and Android.
- Intrusive permissions, outdated libraries, and missing privacy policies expose user data.
- Cases of scam apps, such as an IPTV+VPN that installs the Klopatra Trojan, worsen the situation.
- Recommendations: Avoid downloads outside of official stores, check permissions, and opt for audited services.
Free VPN apps , which promise anonymity and security, are under scrutiny for exposing users' sensitive data. A new independent analysis warns that millions of people may be unknowingly handing over their information every time they activate one of these tools.
The research covers both iOS and Android and concludes that not all free VPNs deliver on their promises : some lack valid privacy policies, request excessive permissions, and use vulnerable components, opening the door to leaks and unauthorized access.
What the Zimperium analysis reveals
The technical report Insecure Mobile VPNs: The Hidden Danger examined 800 mobile VPN apps — 400 for iOS and 400 for Android — and found a worrying pattern in many of them.
According to the data, 25% of free VPNs for iOS lack a valid privacy policy , a violation that leaves users unclear about how their data is handled.
On Android, the problem is no less significant: 18% of the apps analyzed do not offer an accessible privacy policy , making it difficult to exercise informed consent and understand with whom data is shared.
The study also found that 6% request privileged permissions that should not be available to a VPN, enabling deep access to the system that multiplies the risk of abuse.
Intrusive permissions and vulnerable libraries
Among the problematic permissions, in Android, AUTHENTICATE_ACCOUNTS and READ_LOGS stand out , which allow managing accounts and reading system logs, respectively, with a potential for spying that is difficult to justify in a VPN.
On iOS, researchers describe continuous requests for access to geolocation and the local network , a combination that can profile movements and scan nearby devices without a sound functional reason.
In addition, several applications integrate outdated versions of OpenSSL vulnerable to Heartbleed (CVE-2014-0160) , a flaw that enables access to memory and exfiltration of keys and passwords.
Even clients with incorrect certificate validation were detected : around 1% were found to be susceptible to man-in-the-middle (MitM) attacks, putting all supposedly encrypted traffic at risk.
A risk that also affects companies
In environments with BYOD policies , an insecure VPN client can become the weak link that leaks corporate data or opens the door to intrusions into internal networks.
The lack of transparency—including missing or inconsistent privacy statements— prevents companies from properly assessing risk and implementing effective controls.
Scam Apps: IPTV+VPN Installs a Banking Trojan
The firm Cleafy warned about Mobdro Pro IP TV + VPN , an app that presented itself as a streaming and VPN solution, but acted as an installer of the Klopatra banking trojan.
Once permissions were granted, the attackers gained full control of the device , with the ability to read messages, steal credentials, and order fraudulent transfers.
The campaign, with nearly 3.000 confirmed infections — mainly in Spain and Italy — relied on social engineering techniques and the abuse of Android Accessibility Services.
Distribution outside of Google Play (sideloading) and the use of two active botnets facilitated the spread, illustrating the added risk of installing apps from unverified sources.
Popular services under scrutiny for transparency and encryption
The VPN Transparency Report prepared by the Open Technology Fund examined 32 commercial providers and documented weaknesses in several highly downloaded services.
Researchers warn of protocols presented as "robust encryption" that actually employ technologies like Shadowsocks , not designed to guarantee end-to-end confidentiality.
With some clients exceeding 100 million downloads , the combination of popularity and opacity in internal workings increases the risk surface for less experienced users.
This finding reinforces the need for any provider handling sensitive traffic.
Why free VPNs are still used and how to reduce the risk
A survey cited by NordVPN reveals that 12% of VPN users in the UK still rely on free services , despite the general awareness level already reaching 80%.
The reasons include the perception of savings, ratings in stores focused on speed , and the false equivalence of "the basics" between free and paid options.
Kaspersky notes that, historically, they have served as bait to monetize data or feed bot networks, something that fits with recent technical findings.
To minimize risks, experts recommend avoiding sideloading , reviewing permissions, and choosing providers with external audits, no-logs policies, and up-to-date encryption . In Spain, INCIBE suggests verifying the company's jurisdiction , the technology used, and its commitment to data protection before installing anything.
The picture painted by these studies is clear: free VPNs, far from protecting your browsing, can actually compromise it . Choosing reliable tools, reading the fine print, and being wary of "unlimited and free" offers are key steps to avoid making privacy a bargaining chip.
