A team of researchers from the University of Michigan, University of New Mexico, and IIT Delhi tested 281 free VPN apps from the Google Play Store and found alarming security failures across many of them. The apps with problems have been installed more than 2.4 billion times combined. Among the worst findings: 29 apps let user traffic leak outside the encrypted tunnel — meaning the sites you visit can still be seen by your internet provider or anyone on your network. Another 61 apps transmitted data in plain text, and 5 apps sent configuration files unencrypted in a way that could allow attackers to hijack your connection entirely. More than 80% of the tested apps contacted advertising and tracking servers, and 76 apps transmitted your phone’s Advertising ID — a persistent identifier used to track you across apps and websites.
Five apps were specifically identified as vulnerable to tunnel hijacking attacks: BambooVPN (Turbo Fast VPN), VPN Pro (Nebula Tech), Free VPN (Appoxide), Hexa VPN, and 101 VPN. The researchers used a testing framework called MVPNalyzer to evaluate each app’s real behavior rather than relying on the apps’ own claims. Many apps advertised “no-logs” or “privacy guaranteed” — but their actual network traffic told a different story.