Popular Android VPN apps found to have security flaws and China links

A Malwarebytes report published on 4 September 2025 highlights security flaws and China links in popular Android VPN apps. The study, “Hidden Links: Analyzing Secret Families of VPN Apps,” is by researchers from the University of Toronto’s Citizen Lab and Arizona State University and warns that several Android VPNs sold on Google Play can let others sniff users’ traffic and misrepresent ownership.

It analysed the 100 most-downloaded VPNs and grouped them into three families; Family A and Family B share hard-coded Shadowsocks passwords, with Family A also using a hard-coded key to create a password, enabling decryption of communications, and Family B noting that relying on Shadowsocks is not synonymous with anonymity.

The researchers report undisclosed location data collection by some providers, and link several apps to Chinese cybersecurity firm Qihoo 360, which the US has sanctioned for ties to the People’s Liberation Army; the Tech Transparency Project has previously connected three providers to Qihoo 360. The article notes that Google could face reputational damage for hosting these deceptive, insecure apps, and Malwarebytes suggests researching security products carefully. According to Malwarebytes, the study stresses that many VPNs are not what they seem, and warns users to opt for trusted providers.