People used to believe VPNs made them anonymous, so they started using free ones — and I don’t know which is funnier: that, or the fact they basically handed hackers the keys to their bank accounts.

A new security warning is putting Android users on high alert. A malicious app disguised as a VPN and streaming service, Mobdro Pro IP TV + VPN, has been discovered spreading through unofficial sources. But rather than delivering free TV channels, it installs a dangerous piece of malware known as Klopatra.

Klopatra is no ordinary virus. It is a banking Trojan and remote-access tool. This malware gives cybercriminals full control of infected devices. They can quietly steal your banking credentials. They can monitor your activity. They can carry out fraudulent transactions without your knowledge.

The infection begins with social engineering. Klopatra masquerades as an IPTV app offering high-quality free streaming. This lure plays on the popularity of pirated streaming services. Since such apps are rarely found in official app stores, users often download them from unofficial sources. This process is called sideloading. It bypasses Google Play Store’s security protections. That makes it easier for malware to infiltrate devices.

This incident is an extreme example of why VPNs, even legitimate ones, require careful scrutiny. A recent VPN Transparency Report exposed worrying flaws in several of the world’s most downloaded VPN apps. These include Turbo VPN, VPN Proxy Master, XY VPN, and others with over 100 million downloads each. Many of them use protocols like Shadowsocks. These protocols were not designed for privacy. That undermines the very promise VPNs claim to deliver.

What this means for users:

1. Be selective. Only download VPNs and streaming apps from trusted sources. These include the Google Play Store, Apple App Store, or the provider’s official website.
2. Check permissions. If an app requests control over your device, accessibility settings, or the ability to install other software, pause and question whether this is necessary.
3. Layer your defenses. Use reliable anti-malware tools. Keep your device updated. Run periodic scans.
4. Stay informed. Cyber threats evolve constantly. Keep up with cybersecurity news. Share important warnings with friends and family.

If you suspect your device may be compromised, delete suspicious apps. Run a trusted security scan. Change your banking credentials immediately.

Because when it comes to VPNs and online privacy, trust is not given – it is earned. And no, VPNs do not make you invisible.