In short: A VPN is a protection tool, but a malicious VPN app can hurt you more than having no VPN at all. Dangerous apps install configuration profiles with root certificates, intercept your traffic, quietly sell your browsing history, and in 2026 there were reported cases where a free "VPN" was used to remotely lock phones and demand a ransom. The simple rule: install a VPN only from a service with a transparent no-logs policy, via the App Store, Google Play, or the official website — and never grant an app a device-management profile or administrator rights.
Why a malicious VPN is worse than none
A VPN routes all of your device's internet traffic through itself — that is both its value and its risk. When an honest service runs the tunnel, it encrypts your data and does not look inside it. When a bad app does the same, it gains access to a stream that previously only your ISP could see: which sites you open, which apps you use, when and from where you go online.
Free and fake VPNs do not run on enthusiasm alone. If you are not paying for the service, your data becomes the product — through advertising injected over your traffic or the resale of your connection to third parties. Security researchers report this regularly when they dissect the trackers and data flows hidden inside free apps. We broke down the economics of these services in our piece on the difference between free and paid VPNs.
The real question is not "VPN or no VPN," but "who exactly are you trusting with all of your traffic." Here trust is not a marketing word but a technical fact that should be backed by reputation, jurisdiction, and a verifiable logging policy.
How malicious VPN apps actually attack
A dangerous app follows a few common scenarios. Understanding the mechanics helps you spot the trap at install time.
- Configuration profile with a root certificate. On iOS an app may ask you to install a profile (Settings → VPN & Device Management). If the profile adds its own root certificate, the operator gains the technical ability to decrypt your HTTPS traffic — that is, read the contents of "secure" connections.
- Device-management (MDM) profile. Worse still is when an app enrolls your phone in a mobile device management system. MDM was built for corporate devices: it can remotely change settings, install apps, and in the worst case lock or wipe the device. A consumer VPN should never ask for this.
- Silent data collection and resale. The app logs the domains you visit, gathers device identifiers, ties them to your IP, and hands the result to data brokers. It is "free" on paper; in practice you pay with your privacy.
- Bundled infostealer or ad module. Under the guise of a VPN, attackers ship code that steals saved passwords, session tokens, and clipboard contents, or replaces pages with its own ads.
- Locking and extortion. In early 2026 there were reports of a scheme where a free VPN app and its linked profile let attackers remotely lock iPhones and demand payment to unlock them. The mechanism is the same — excessive privileges the user granted during installation.
App requests: what is normal and what is a red flag
An honest VPN needs exactly one system element to work — the VPN configuration. On iOS it appears at the first connection; on Android it is the system "VPN" permission. Anything beyond that deserves questions. Check the table below before you tap "Allow."
| What the app requests | Does an honest VPN need it? | What you risk |
|---|---|---|
| VPN configuration / system "VPN" permission | Yes, required | Normal: the tunnel will not start without it |
| Installing a root certificate | Almost never | Decryption of your HTTPS traffic |
| Device-management (MDM) profile | No | Remote lock, wipe, settings tampering |
| Device administrator rights (Android Device Admin) | No | Control over locking and resetting the phone |
| Contacts, SMS, Accessibility services | No | Reading your messages and capturing typed text |
| Disabling updates or security features | No | The phone stays exposed to known vulnerabilities |
Where to download a VPN and how to vet the source
Most dangerous apps are filtered out at a single step — choosing the source. There are only three safe channels: the App Store, Google Play, and the service's official website. Stores are not a hundred-percent guarantee, but their review process weeds out obvious junk, and you can verify the chain of app → developer → domain.
TestFlight is a separate question. It is Apple's official beta-testing tool and is safe in itself. What makes a link dangerous is not TestFlight but where it points: open a beta only through a link from the official website or the service's account, never one forwarded in a chat. Before installing, check the developer name and domain — they should match what the service publishes. We showed what a correct iOS install looks like in our guide to setting up a VPN on iPhone.
Red flags of a dangerous VPN
Beyond the permissions it requests, a bad service has outward signs. None is a verdict on its own, but two or three together are reason enough to delete the app.
- The app is distributed only via a link in a chat or from an obscure site, bypassing the App Store, Google Play, and any official page.
- The service has no clear privacy policy, legal entity, or contacts, and its domain was registered a couple of weeks ago.
- A promise of "free forever, unlimited, no sign-up" despite the genuinely high cost of running servers.
- Reviews appeared in a single-day batch, all worded alike, while complaints about charges and lockouts are hidden or deleted.
- The app asks you to turn off system security features or to "trust" an unknown developer in settings.
How an honest VPN service behaves
By contrast, the marks of a trustworthy service are a mirror image. It discloses who owns it, which jurisdiction it operates under, and on what terms. It asks for neither root certificates, nor an MDM profile, nor administrator rights — only the basic VPN configuration.
A technically mature service builds the tunnel on modern protocols: WireGuard (ChaCha20-Poly1305 encryption), OpenVPN, or IKEv2 — with no homemade "secret" cryptography. It publishes a no-logs policy and, ideally, backs it with an independent audit. You can check such claims with a clear method — we describe it in the article on how to verify a VPN keeps no logs. It also helps to know the limits of the technology up front: what a VPN protects against and what it does not.
Transparency costs money: servers, support, and audits are never free, so a clear subscription is a sign of health, not a drawback. If you are choosing between a dubious "free forever" app and an affordable service with a real legal entity and real support, look at the LiMP plans: a fixed price and a no-logs policy are exactly the case where you pay for the service rather than with your data.
Checklist: installing a VPN safely
- Download the app only from the App Store, Google Play, or the service's official website.
- Match the developer name and domain against what the service publishes.
- During setup, allow only the VPN configuration; decline requests for a root certificate, an MDM profile, or administrator rights.
- Read the privacy policy: look for an explicit "no-logs" statement and a mention of an independent audit.
- Check the service's jurisdiction and legal entity, and confirm there are live support contacts.
- After connecting, confirm the tunnel actually works and leaks nothing — using our VPN testing checklist.
- Once a month, review your profiles and permissions: nothing extra should be there.
Your phone is already at risk: what to do
If you installed a questionable app or noticed an unfamiliar profile, work through it in order, without panicking.
- iPhone: open Settings → General → VPN & Device Management. Remove any unknown configuration profiles and any MDM profiles you did not deliberately install.
- Android: in Settings → Security → Device admin apps, revoke rights from the suspicious app, then uninstall it. Also check the Accessibility section.
- Delete the VPN app itself and restart the phone.
- Change the passwords of key accounts (email, bank, Apple ID / Google) and turn on two-factor authentication.
- Check whether your data has leaked — using the guide on how to check for a personal data breach.
- If the phone is locked and a ransom is demanded, do not pay. Contact official Apple or Google support: paying does not guarantee an unlock and only rewards the attackers.
Frequently asked questions
Can a free VPN really lock my phone?
It is not "VPN as a technology" that can lock a device, but the excessive privileges an app receives at install time — chiefly an MDM profile or administrator rights. Without those permissions, an ordinary VPN tunnel cannot control locking.
Is a VPN from the App Store or Google Play one hundred percent safe?
No. Store review lowers the risk and removes obvious junk, but it does not remove the need to check the logging policy, jurisdiction, and requested permissions. The store is a necessary condition, not a sufficient one.
How do I quickly check which profiles are on Android?
Look in Settings → Security → Device admin apps and in Settings → Accessibility. A VPN should not be there: the tunnel only needs the system "VPN" permission. Anything extra in those sections is a reason to be cautious.
Is it dangerous to install a VPN via TestFlight?
TestFlight itself is Apple's official service and is safe. The risk comes from the link's source: open a beta only from the service's page or account, not from a forwarded chat link, and verify the developer.
I already paid for an "unlock" — what now?
Treat the money as lost and do not pay again. Remove the foreign profiles, change your passwords, turn on two-factor protection, and contact the manufacturer's official support. Paying offers no guarantee and only confirms to the attackers that the scheme works.
Do I still need antivirus if I have a VPN?
They solve different problems. A VPN encrypts and hides traffic, but it does not scan files or block malicious apps. On a phone, your baseline defense is system updates, installing apps only from trusted sources, and care with permissions.
Can an honest VPN see which sites I open?
Technically all traffic passes through the service's servers, so what matters is not "can it" but "does it store that data." That is exactly why a verifiable no-logs policy and an independent audit matter — a claim without proof is worth little.