A VPN app asks for a lot of trust. It sits between your phone and the internet, and people often install one in a hurry: before a trip, after a news story, or because a friend sent a link in a chat. Criminals know this, so "free VPN" is one of the disguises they use for malware.

This article looks at a documented case, explains why apps installed from outside the official stores carry most of the risk, and gives you a checklist of warning signs you can use before you tap Install.

A real case: a TV-and-VPN app that emptied bank accounts

In late September 2025, the security firm Cleafy published research on a new Android banking trojan it named Klopatra. The malware was spread through an app that posed as a free IPTV service with a built-in VPN. Malwarebytes, writing about the research on 9 October 2025, described it as a malicious sideloaded app, not a legitimate VPN, which gave attackers full remote control of infected phones so they could steal credentials and make fraudulent transactions.

Cleafy's findings show how the trick worked:

  • The lure was free TV. People who expect unofficial streaming apps to come from websites rather than app stores were willing to install it from outside Google Play.
  • A harmless-looking installer. The first app had a simple screen with a "continue with the installation" button. It sent the user to Android settings to allow installing unknown apps, then silently installed the real malware.
  • Accessibility was the key. The malware then asked for Accessibility Services, which Cleafy calls crucial to its success. With that access it could tap "Allow" or "OK" on other permission dialogs by itself.
  • It worked while you slept. Operators preferred to act at night when the phone was charging and the screen was off, and could show a black overlay so the phone looked switched off while they used it remotely.

Cleafy said the operation had compromised over 3,000 devices at the time of its analysis (the report also cites more than 1,000 confirmed victims), mainly in Spain and Italy, and had tracked more than 40 builds since March 2025.

Why sideloaded apps carry most of the risk

"Sideloading" means installing an app file (an APK on Android) from a website, a chat, a file-sharing link or an ad, instead of from an official store. It is not always dangerous, and some legitimate developers offer direct downloads. But it removes several safety nets:

  • No store review. Official stores review apps before publishing them and can remove them when problems are found.
  • No clear publisher. A file in a chat can claim to be anything. You can't easily see who made it.
  • No trusted updates. A fake app can later download extra code, or ask you to install "updates" from the same source.

Fake apps also travel through lookalike websites with names close to a real brand, through ads in search results, and through messages promising a "premium version for free".

Warning signs checklist

Stop and think if you see any of these:

  • The app is not in an official store, and the link came from a chat, a forum, a pop-up or an ad.
  • It asks you to allow "Install unknown apps" during setup. A VPN app installed from Google Play has no need to install other apps. If you install our Android app from the direct APK, download it only from vpnrice.com; it is your browser, not the VPN app, that asks for install permission.
  • It asks for Accessibility Services. Malwarebytes advises asking yourself why an app wants control over your device, your settings or Accessibility, or wants to install other apps. A VPN does not need to read your screen.
  • It promises too much: free premium TV channels, "hacked" paid features, or a VPN bundled with something unrelated.
  • The publisher name doesn't match the brand, or the developer has no website, privacy policy or contact address.
  • Reviews look fake: many short five-star reviews posted at once, or recent reviews mentioning ads, battery drain or strange charges.
  • The website is a near-copy of a real one, with a slightly different domain name.

Safer download habits

Use the official store, or the developer's own site

Install VPN apps from Google Play, the App Store or the provider's official website, which is also Malwarebytes' advice. If you type the address yourself instead of clicking an ad, you avoid most lookalike sites.

Check the publisher and the details

On the store page, look at the developer name, the official website link, the privacy policy and the update history. Since January 2025, Google Play shows a "Verified" badge on VPN apps that have passed an independent security check known as MASA Level 2, according to the Android Developers Blog. It doesn't make an app perfect, but it is a useful signal.

Read permissions before you accept

A VPN app will ask to set up a VPN connection; Android shows a system dialog for this. It may ask to show notifications. Requests for Accessibility, SMS, contacts or installing other apps deserve a very good reason.

Keep things updated

Keep Android, your apps and any security software updated, so known holes are fixed.

If you think you installed a fake app

  1. Disconnect the phone from the internet (turn on airplane mode).
  2. Uninstall the app. If it won't uninstall, check Settings for Accessibility and device admin entries and turn them off first.
  3. Run a scan with a trusted security app.
  4. From a different, clean device, change your banking and email passwords and contact your bank if you see anything unusual.
  5. Turn on 2-step verification for important accounts.

Where to get VPNRice

If you use VPNRice, download it only from the official store listings or from our own site: Android, Android TV and iPhone and iPad. Our download pages link to the official sources, so you don't need to trust files passed around in chats. The VPNRice Android app does not ask for Accessibility access or for permission to install other apps.

Key takeaways

  • Free VPN and free TV are common disguises for malware, especially outside official stores.
  • "Install unknown apps" and "Accessibility" requests from a VPN or TV app are red flags.
  • Check the publisher, website, privacy policy, reviews and, on Google Play, the Verified badge.
  • If something feels wrong, uninstall, scan and change passwords from another device.