Your VPN could be spying on you, Google warns

According to TechRadar, Google’s November 2025 fraud and scams advisory reveals that cybercriminals are distributing malicious applications disguised as legitimate VPN services, exploiting users’ privacy concerns to steal sensitive data including browsing history, private messages, financial credentials, and cryptocurrency wallet details. The alert specifically warns about fraudulent VPN apps and browser extensions that manage to appear on official app stores while secretly containing dangerous payloads like info-stealers and banking trojans. This comes as TechRadar’s own survey found nearly one in four readers use free VPNs, creating a massive target for threat actors. The situation is so severe that even Google’s security badges aren’t foolproof, with malicious extensions previously obtaining official verification despite being designed to spy on users.

The ultimate betrayal

Here’s the thing that makes this so insidious: we’re talking about tools people specifically choose because they want more security and privacy. And they’re getting exactly the opposite. Imagine downloading something because you’re worried about being watched, only to discover you’ve invited the watcher right into your digital life.

These fake VPNs aren’t just poorly made apps – they’re sophisticated traps. They look legitimate, they get fake positive reviews, they might even work as VPNs while simultaneously running malware in the background. It’s the digital equivalent of a security guard who’s actually a burglar casing your house.

The free VPN dilemma

Let’s be real – the free service model is where most of these problems live. When something’s free, you’re often the product. But in this case, you’re not just being monetized – you’re being actively exploited.

TechRadar does mention some safer free options like Proton VPN Free and PrivadoVPN Free, but even they acknowledge that premium services are generally safer. Basically, if a free VPN promises unlimited everything with no catch, your skepticism meter should be pegging the red zone.

How to actually stay safe

Google‘s advice about sticking to official app stores is a start, but we’ve seen that’s not enough. So what actually works? First, check those app permissions like a hawk. A VPN shouldn’t need access to your contacts, photos, or messages. That’s just common sense.

Second, look for providers with transparent business models and independent security audits. Established companies have reputations to protect – fly-by-night operations don’t. And honestly, with Black Friday deals making premium VPNs more affordable, the risk-reward calculation has never been clearer.

The scary truth is this problem isn’t going away. As privacy concerns grow, so will the sophistication of these scams. Your best defense? Assume nothing is as it seems and do your homework before clicking install.