A free Chrome VPN with over 100,000 installations has been accused of snapping unauthorised screenshots of websites and spying on its users location data

2025-08-22 11:53:00
www.pcgamer.com

Here’s a useful piece of advice right up top—don’t use a free VPN. Many will have serious caveats, as demonstrated by the security researchers at Koi, who say they’ve discovered a particularly popular Chrome-based variant taking unauthorised screenshots and spying on its users.

The accused Chrome extension is called FreeVPN.One, and it’s currently sat at 100,000+ downloads on the Chrome Web Store—complete with a coveted “featured” badge that supposedly marks its compliance with recommended practices (via Sweclockers).

After discovering the extension and taking a closer look at the code, Koi’s researchers discovered that FreeVPN.One was silently capturing screenshots exactly 1.1 seconds after any page was loaded, before sending them back to its home server with the page URL, tab ID, and a unique user identifier.

The VPN extension features a “Scan with AI Threat Detection” tool, which, its privacy policy states, may upload screenshots of specific pages and URLs to its secure servers. However, according to the team at Koi, FreeVPN.One was found to be busy taking screenshots of every page well before the tool was deployed, with its users being none the wiser.

It gets worse, too. Koi claims that not only has the VPN been categorising and phoning home geolocation and device data alongside the screenshots in recent months, but the latest version also introduces AES-256-GCM encryption with RSA key wrapping (I only know what some of those words mean), which means the exfiltration of its findings back to its home server is now far harder to detect.

A creepy dude snapping pics through blinds.

(Image credit: D-Keine/Getty)

The team at Koi believes the spying behaviour started in April of this year, when a permission update enabled the extension to access every site a user visited. A quick succession of updates over the next few months appears to have further enhanced its permissions access, which Koi characterises as the developer experimenting to see how far they could push the extension without raising suspicion.

The silent screenshot behaviour, along with location tracking and data exfiltration, is said to have begun on July 17. In the next update, the aforementioned encryption was added, along with a switch to a new subdomain.

Koi reached out to the extension’s sole developer for comment, who initially responded, denying its findings. The dev claimed that the automatic screenshot capture was part of a background scanning feature and would only trigger if a domain appeared suspicious—but the researchers say they have observed screenshots being captured on a wealth of trusted sites, including Google Sheets and Google Photos.

An image of a close-up of a human eye on lap top computer in a domestic kitchen, at night

(Image credit: PM Images via Getty Images)

When asked to provide evidence of legitimacy in the form of a company profile, GitHub account, or LinkedIn page, the team claims the developer stopped responding to their emails, leaving behind one known address that corresponds with a free-tier Wix template page.

Call me an amateur sleuth if you like, but that doesn’t seem like the most trustworthy behaviour to me. At the time of writing, FreeVPN.One is still available on the Google Web Store—with a 3.7 star review page now full of angry comments from users referencing Koi’s investigation.

Even if the screenshot-snapping behaviour was a legitimate mistake, it seems like the free tool’s time in the sun may be over, although the fact that it’s still available with the same “featured” badge is troubling. Here’s hoping it’s soon scoured from the store, with an important lesson learned. Pay for a trustworthy VPN, folks. The free ones usually aren’t worth the risk.

Best gaming monitors 2025

Source Link

Take your gaming to the next level! The Redragon S101 RGB Backlit Gaming Keyboard is an Amazon’s Choice product that delivers incredible value. This all-in-one PC Gamer Value Kit includes a Programmable Backlit Gaming Mouse, perfect for competitive gaming or casual use.

With 46,015 ratings, an average of 4.6 out of 5 stars, and over 4K+ bought in the past month, this kit is trusted by gamers everywhere! Available now for just $39.99 on Amazon. Plus, act fast and snag an exclusive 15% off coupon – but hurry, this offer won’t last long!

Score this incredible deal now!

Unlock unlimited streaming with a free Amazon Prime trial!
Sign up today!

Help Power Techcratic’s Future – Scan To Support

If Techcratic’s content and insights have helped you, consider giving back by supporting the platform with crypto. Every contribution makes a difference, whether it’s for high-quality content, server maintenance, or future updates. Techcratic is constantly evolving, and your support helps drive that progress.

As a solo operator who wears all the hats, creating content, managing the tech, and running the site, your support allows me to stay focused on delivering valuable resources. Your support keeps everything running smoothly and enables me to continue creating the content you love. I’m deeply grateful for your support, it truly means the world to me! Thank you!

BITCOIN

Bitcoin Logo