Kaspersky Finds 15 Million Cyber Attacks Disguised As VPN Applications

VPN illustration (photo: Unsplash)

Using a virtual private network (VPN) is a common thing for many people, especially Gen Z, to access certain sites, whose IP addresses are blocked in one country.

However, behind this convenience, it turns out that Kaspersky's global cybersecurity company found an unexpected danger from the attackers on behalf of the VPN.

"Generation Z may be aware of privacy, but they are also pragmatic and often driven by convenience. This behavior creates gaps that are actively exploited by cybercriminals," said Evgeny Kuskov, Security Expert at Kaspersky.

Throughout October 2024 to September 2025, Kaspersky experts detected more than 15 million attempted attacks disguised as various VPN applications.

In the observation period, the most common threat targeting users is dominated by three categories of unwanted malware and software.

AdWare leads the list with 284.261 cases, continuing to disturb users through annoying ads, unwanted diversions, and aggressive tracking.

Trojans follow with 234.283 detections, posing a serious danger to its ability to steal data and enabling complete remote control over compromised systems.

Downloader-type (downloader) threats are in third place with 197.707 cases detected, reflecting their role as the main entry point for installing additional malicious payloads on victims' devices.

Kaspersky researchers also identified phishing pages that mimic entry portals for well-known VPN services. These sites trick users into entering their credentials, potentially losing access to many of their accounts.

"The striker may deliberately promote a pirated version of the premium VPN service and create an application that imitates the names and designs of well-known privacy brands," Evgeny added.

Therefore, Kaspersky emphasized that the public should pay more attention to the authenticity of a site, and be careful not to provide personal information online.