FreeVPN.One extension captures screenshots and transmits data

A widely used free Chrome VPN extension, FreeVPN.One, has been found to covertly spy on its users by capturing screenshots of every webpage they visit and transmitting those images to a domain controlled by the developer. The discovery, attributed to researchers at Koi Security, traces a deterioration in user privacy that began with a permissions upgrade in spring 2025 and intensified through mid-summer updates. Despite its Google “Featured” and “Verified” badges and more than 100,000 installations, the extension appears to have shifted from providing security benefits to enabling persistent data collection without clear user consent.

FreeVPN.One was launched in 2020 and earned a place in the Chrome Web Store under two prominent Google badges that signal trust and reliability. Beginning in April 2025, the extension received an all_urls permission, enabling access to every site a user visits. This broad access marked the first step toward more intrusive data collection, according to researchers. In July, version 3.1.3 was released with further changes that allowed the extension to silently capture screenshots of users’ online activity. The researchers noted an additional layer...