Why a malicious VPN is worse than having none at all
A VPN routes all of a device's internet traffic through itself — that's both its benefit and its risk. When a legitimate service runs the tunnel, it encrypts your data and doesn't look inside it. When a dishonest app does the same thing, it gains access to a stream that used to be visible only to your internet provider: which sites you open, which apps you use, and when and from where you go online.
Free and fake VPNs don't run on pure enthusiasm. If you're not paying for the service, the revenue comes from your data, ads injected into your traffic, or reselling your bandwidth to third parties. Security researchers regularly report on this when they analyze trackers and data transfers inside free apps. We covered the economics of such services in detail in our piece on whether it's safe to pay for a VPN.
The key point: the question isn't “VPN or no VPN”, but “exactly who are you trusting with all of your traffic”. Trust here isn't a marketing word — it's a technical fact that has to be backed by reputation, jurisdiction, and a verifiable logging policy.
How malicious VPN apps actually attack
A dangerous app has a handful of typical playbooks. Understanding the mechanics helps you catch the problem as early as the install step.
- A configuration profile with a root certificate. On iOS, an app may ask you to install a profile (Settings → “VPN & Device Management”). If the profile adds its own root certificate, the service owner gains the technical ability to decrypt your HTTPS traffic — meaning they can read the content of “secured” connections.
- A device-management (MDM) profile. Even more dangerous is when an app enrolls your phone into a mobile-management system. MDM was built for corporate devices: it lets someone remotely change settings, install apps, and, in the worst case, lock or wipe the device. A consumer VPN has no business asking for this.
- Silent data collection and resale. The app logs the domains you visit, collects device identifiers, ties them to your IP, and hands them to data brokers. It's “free” on paper, but in practice you pay with your privacy.
- A built-in infostealer or ad module. Code disguised as a VPN steals saved passwords, session tokens, and clipboard contents, or replaces page content with its own ads.
- Lockout and extortion. In early 2026, reports surfaced of a scheme where a free VPN app and its associated profile let attackers remotely lock an iPhone and demand payment to unlock it. The mechanism is the same one every time — excessive permissions the user granted at install time.
A confirmed 2026 case: a Russian Interior Ministry warning
This isn't a hypothetical risk. In late May 2026, the Russian Ministry of Internal Affairs' department for combating the unlawful use of information and communication technologies issued an official warning about an app disguised as a free VPN: instead of the advertised VPN service, it installs malware on the device, including banking trojans and additional virus modules. According to the agency, the app can access SMS messages, push notifications, and banking-app data, and can covertly download further dangerous components to the phone or computer. The recommendations match the basic rules in this article: install apps only from official stores (though even that is no absolute guarantee), and carefully review the permissions requested at install time.
App signals: what's normal and what's a red flag
A legitimate VPN needs exactly one system-level element to work — a VPN configuration. On iOS it appears the first time you connect; on Android it's the system “VPN” permission. Anything beyond that deserves scrutiny. Check the table below before tapping “Allow”.
| What the app is asking for | Does a legitimate VPN need it? | What you risk |
|---|---|---|
| VPN configuration / system “VPN” permission | Yes, required | Normal: the tunnel can't come up without it |
| Installing a root certificate | Almost never | Decryption of your HTTPS traffic |
| Device-management profile (MDM) | No | Remote lock, wipe, settings tampering |
| Admin rights (Android Device Admin) | No | Control over locking and resetting the phone |
| Contacts, SMS, Accessibility services | No | Reading messages and capturing typed text |
| Disabling updates or protective features | No | The phone stays exposed to known vulnerabilities |
Where to download a VPN and how to verify the source
Most dangerous apps are filtered out at a single step — choosing the source. There are only three safe channels: the App Store, Google Play, and the service's official website. Stores don't offer a hundred-percent guarantee, but their moderation weeds out the obvious junk, and the app-developer-domain chain can be checked.
TestFlight deserves a separate note. It's Apple's official beta-testing tool and is safe on its own. What makes a link dangerous isn't TestFlight — it's where the link came from: only join a beta through a link from the official website or the service's own account, never one sent in a messenger app. Before installing, verify the developer name and domain match what the service states.
Red flags of a dangerous VPN
Beyond the permissions it requests, a dishonest service has external warning signs too. None of them is a death sentence on its own, but two or three together are reason enough to delete the app.
- The app is distributed only through a messenger link or an unfamiliar site, bypassing the App Store, Google Play, and an official page.
- No clear privacy policy, no legal entity, no contact information — and the domain was registered a couple of weeks ago.
- A promise of “free forever, no limits, no sign-up” despite server infrastructure that is inherently expensive to run.
- Reviews that appeared in a single burst, all reading the same, with complaints about charges and lockouts hidden or removed.
- The app asks you to disable system protections or “just trust” an unknown developer in settings.
How a trustworthy VPN service behaves
By contrast, the signs of a legitimate service are a mirror image. It discloses who owns it, which jurisdiction it operates in, and under what terms. It doesn't ask for root certificates, an MDM profile, or admin rights — only the basic VPN configuration.
A technically mature service builds its tunnel on modern protocols — WireGuard (ChaCha20-Poly1305 encryption), OpenVPN, or IKEv2 — without homegrown “secret” cryptography. It publishes a no-logs policy and, ideally, backs it with an independent audit.
Transparency costs money: servers, support, and audits aren't free, so a clear subscription price is a sign of health, not a drawback. If you're choosing between a dubious “free forever” app and an affordable service with a registered legal entity and real support, take a look at the LiMP pricing page: a fixed price and a no-logs policy are exactly the case where you pay the service, not with your data.
Checklist: installing a VPN safely
- Download the app only from the App Store, Google Play, or the service's official website.
- Check that the developer name and domain match what the service states.
- During setup, allow only the VPN configuration; decline requests for a root certificate, an MDM profile, or admin rights.
- Read the privacy policy: look for an explicit no-logs statement and a mention of an independent audit.
- Verify the service's jurisdiction and legal entity, and make sure real support contacts exist.
- After connecting, confirm the tunnel actually works and there are no leaks — see our guide to checking your VPN's anonymity.
- Check your profiles-and-permissions section once a month; nothing extra should be sitting there.
Your phone may already be at risk: what to do
If you've installed a questionable app or noticed an unfamiliar profile, work through this calmly and in order.
- iPhone: open Settings → “General” → “VPN & Device Management”. Remove any unfamiliar configuration profiles and any MDM profiles you didn't knowingly install.
- Android: under “Settings → Security → Device admin apps”, revoke the suspicious app's rights, then uninstall it. Also check the “Accessibility” section.
- Delete the VPN app itself and restart the phone.
- Change the passwords on your key accounts (email, bank, Apple ID / Google) and turn on two-factor authentication.
- Check whether your personal data has leaked anywhere.
- If your phone is locked and a ransom is demanded, don't pay. Contact official Apple or Google support — paying doesn't guarantee you'll get access back and only encourages the scammers.
