A VPN (Virtual Private Network) service, which touts itself as a tool for increasing user privacy and security, has been exposed for secretly monitoring its users. According to a report from Koi Security, the FreeVPN.One application, offered as a Chrome extension, tracks users through various methods.

This incident once again shows that software that appears to be a security tool can actually pose serious risks.

The FreeVPN.One Extension Tracks Users

According to the report, the FreeVPN.One extension takes a screenshot of every website a user visits after the page has fully loaded. This process is linked to a feature the application calls “AI Threat Detection.”

When a user clicks a button for this feature, a screenshot is taken to scan the site and is sent to FreeVPN.One’s servers for threat analysis. However, Koi Security’s findings reveal that the extension automatically records every page visited, even if the user takes no action. This makes the application’s privacy violations far more serious.

The VPN extension also collects users’ IP addresses to determine their location and gains access to all URLs through extensive browser permissions. The “<all_urls>” permission allows the extension to access every site the user visits.

Koi Security stated that FreeVPN.One expanded its permissions and began monitoring user data in April of this year. The extension’s developer was found to have attempted to hide these activities through changes made in later versions. Although the developer claims that screenshots are not stored permanently and that user data is not sold, they remain anonymous and avoid providing extensive details.