This free Chrome VPN extension found to spy on its 100k+ users – uninstall it now

News
By published

Despite boasting a Google-verified badge, FreeVPN.One was found to take screenshots of every page you visit

In this photo illustration, a silhouetted woman holds a smartphone with the Google Chrome logo displayed on the screen.
Image credit: Pixabay (Image credit: Photo Illustration by Rafael Henrique/SOPA Images/LightRocket via Getty Images)
  • Security researchers found that a popular free Chrome VPN extension has been stealthily taking screenshots of every website its users visit
  • FreeVPN.One boasts over 100,000 downloads and Google's "Verified" and "Featured" badges
  • Once limited to VPN functionality, the extension's later updates were designed not for privacy, but to evade detection

A popular Chrome VPN extension has been found to spy on its over 100,000 users.

Koi Security published an extensive report, warning users that instead of protecting their data as the best VPN apps should do, FreeVPN.One takes screenshots of every single website they visit.

FreeVPN.One is a free VPN extension that managed to obtain two badges from the Google Chrome Store, supposedly to further assure users of its security. Unfortunately, those badges might have been mistakenly awarded.

A trustworthy VPN extension turned into a privacy nightmare

A screenshot taken of FreeVPN.One's Google Chrome Web Store page on August 21, 2025

(Image credit: Google)

FreeVPN.One looks legitimate at a glance. With over 100,000 downloads and Google's endorsement, it seems like a secure alternative to paid VPN services. However, according to Koi Security, there's a sinister reality hiding just underneath the surface.

The extension was marketed as a free, unlimited VPN service, and according to researchers, for a while, it did just that. However, future updates introduced a worrying development.

Koi Security reports that just seconds after any page loads, a background trigger grabs a screenshot of it. This means that every website you visit with the extension enabled is captured, including private photos, banking sites, medical records, and all kinds of other sensitive information.

The screenshots are then sent to an external source, with scripts running to ensure the quality of data capture.

A screenshot featuring various private pictures sent to FreeVPN.One’s backend

Even private pictures were sent to FreeVPN.One’s backend, as per Koi Security findings (Image credit: Koi Security)

Another feature in FreeVPN.One, called "AI Threat Detection," also takes screenshots and uploads them for server-side analysis, but at least this one discloses that it does that, whereas the rest of the app does not.

A few of the most recent updates to FreeVPN.One appears to have made things worse for user privacy. The spyware, screenshots, and location tracking allegedly started in July of this year. Later that same month, Koi Security reported, the developer upped the security to evade detection, all the while the screenshots continued being collected.

Koi Security reached out to the developer, who claims that screenshots are only taken if the domain appears suspicious. However, even websites like Google Photos are recorded, which doesn't line up with that claim. The dev also says that the screenshots are not stored anywhere, but this is a difficult claim to verify. They eventually allegedly stopped responding to Koi Security's requests for comment.

How to stay safe?

This situation outlines a larger problem with certain free VPNs, as well as the ease with which certain developers can upload malicious apps into web stores and gain user trust. Just recently, a VexTrio Viper, a group of cybercriminals, successfully shared a long list of malicious apps through popular app stores. This included a free VPN, ad blocker, and even an online dating service.

FreeVPN.One scored Google Play Store's "Verified" badge, which should have meant it was definitely secure, but it sounds rather like "it's best avoided."

If you used the FreeVPN.One extension, we recommend that you uninstall it immediately. Consider downloading one of the best antivirus programs to give your PC a thorough scan, too.

Next, it's time to change your passwords to just about every website you may have accessed while using the extension. Better to be safe than sorry.

This highlights just how important it is not to take chances when using a VPN service, which, by default, often has pretty hefty permissions when it comes to monitoring what you do. If you aren't willing to get a premium service, turn to some of the best free VPN services to ensure they have been thoroughly tested in order to protect your data.

You might also like

Monica J. White
Monica J. White
Contributing Writer

Monica is a tech journalist with over a decade of experience. She writes about the latest developments in computing, which means anything from computer chips made out of paper to cutting-edge desktop processors.

GPUs are her main area of interest, and nothing thrills her quite like that time every couple of years when new graphics cards hit the market.

She built her first PC nearly 20 years ago, and dozens of builds later, she’s always planning out her next build (or helping her friends with theirs). During her career, Monica has written for many tech-centric outlets, including Digital Trends, SlashGear, WePC, and Tom’s Hardware.

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.