Security researchers warn of scam VPN apps on iOS

in General Discussion edited June 2020
Security researchers at Avast have discovered and reported three iOS VPN apps that were attempting to scam users into buying expensive subscriptions that charged them once a week.

Virtual private networks, or VPNs, are apps that route internet traffic through a "tunnel," often for security and privacy purposes. Security experts have long cautioned users from downloading untrusted VPNs, however, as malicious variants can in some cases glean sensitive information without a user's knowledge.

The three apps that Avast researchers discovered were high-rated VPN apps that "overcharge users, do not provide the services they promote and appear to be 'fleeceware.'"

"Fleeceware apps fall into a gray area, because they are not malicious per se, they simply charge users absurd amounts of money for weekly, monthly or yearly subscriptions for features that should be offered at much lower costs," said Nikolaos Chrysaidos, Avast's head of Mobile Threats and Security.

Researchers found that the three apps charge $9.99 a week for a subscription after a free three-day trial. When they purchased a subscription and attempted to use the VPNs, they only found additional prompts to buy access. Because the researchers already had an existing subscription, the apps showed an error message alerting them of that fact. They were thus "unable to establish a VPN connection" using them.

The three apps are Buckler VPN, Hat VPN and Beetle VPN. All three are still available on the iOS App Store and have ratings ranging from 4.6 to 4.8 stars. Avast notes that the apps don't contain malicious components, so they were able to circumvent Apple's App Store guidelines.

Avast also notes that they found evidence that the app's high-rating reviews were fake. Most of them were similarly written, and peppered in between them were comments warning of scammy functionality. The apps' privacy policies were also written with "very similar language and structure."

The security company recommends users pay close attention to what types of charges can be expected after any app free trial ends, and to closely monitor credit card charges to ensure they aren't being overcharged. Avast says it reported all three apps to Apple.

"With many people turning to VPN apps to protect their data while working remotely, this illustrates how important it is for users to research VPN apps before installing them, including who is behind the product, their track record with other products and user reviews, and experience in offering security and privacy apps," Chrysaidos said.


  • Reply 1 of 9
    Bit misleading and unfair to show NordVPN in your header picture, don't you think? They're not part of those three fleeceware apps...
  • Reply 2 of 9
    SamhainSamhain Posts: 8member
    Agree superkloton, has been posted for over 12 hours and no one has fixed this issue, come on AppleInsider team!
  • Reply 3 of 9
    SpamSandwichSpamSandwich Posts: 33,407member
    So which ARE the good VPN’s? This is an incomplete article without that information.
  • Reply 4 of 9
    Why not use, Cloudflare's free VPN app and service?

    Although I know of one IT consultant who is a little too arrogant about his own knowledge. I had set as the DNS on my personal MBP. He didn't know what it was. When told it's Cloudflare's servers, he claimed it's not and said they're offshore and dangerous. Yeah, they're so dangerous that Mozilla changed recent Firefox releases to automatically default to I hate IT know-it-alls.
  • Reply 5 of 9
    chasmchasm Posts: 2,611member
    I cannot imagine signing up for any VPN service that I have never heard of before, that I don't know a lot about their business, server locations, and retention policies -- verified independently -- no matter how cheap. But then I'm a weirdo like that.

    I hope Apple will take corrective action soon, but in the meantime we could be helping by reporting these apps within the App Store.

    I do find it amusing that Avast -- a company my Windows clients have nothing but trouble with, particularly at the free tier -- has a security division. It's a bit like Google complaining that Facebook gathers sensitive user data without consent ...
  • Reply 6 of 9
    macguimacgui Posts: 2,259member
    So which ARE the good VPN’s? This is an incomplete article without that information.
    Bullshit. The article is about some specific VPN apps that were found to be scams. It's not a review of VPN apps in general.

    Naming "the good VPNs" requires a whole different article of reviewing every fucking VPN app. Even finding "some good VPNs" requires a lot of research. That's far beyond the scope of this article.

    "There are scam VPN apps out there. Here are three. Beware the fees." Job done. 
  • Reply 7 of 9
    bulk001bulk001 Posts: 716member
    The thumbnail image on the main page STILL shows NordVPN’s logo even thought several people have pointed out the fact that it does not involve them! Freaked me out as I use VordVPN 24/7 on all my devices. Maybe less blah blah blah about Dear ... and more focus on getting your content accurate first?
  • Reply 8 of 9
    DAalsethDAalseth Posts: 2,567member
    This shines a light on something I’ve wanted for a year or more. 

    I would really like to see somebody more reliable than Zekes Product Reviews That Are Totally Not Paid For By The Manufacturers, did a review of malware security packages. I’ve uses Avast for several years, but I don’t know if they are the best. I don’t know if their optional VPN is as good as Nord that I use. I don’t know anything about ransomeware protection. I really have no idea what is good and what isn’t any more. The online world has gotten to be quite hazardous. I don’t know that the Malware package I use is satisfactory any more. I’d love to see someone reliable, like AppleInsider look over a bunch of them and let us know what’s good and what is a screen door.
  • Reply 9 of 9
    toysandmetoysandme Posts: 243member
    Some former Google employees turned whistleblowers use ProtonMail and their VPN services. I have both their free but limited accounts and their basic package as well. Very happy so far, in part because it’s not US based. 
Sign In or Register to comment.