A free Chrome VPN with over 100,000 installations has been accused of snapping unauthorised screenshots of websites and spying on its users location data

Here's a useful piece of advice right up top—don't use a free VPN. Many will have serious caveats, as demonstrated by the security researchers at Koi, who say they've discovered a particularly popular Chrome-based variant taking unauthorised screenshots and spying on its users.

The accused Chrome extension is called FreeVPN.One, and it's currently sat at 100,000+ downloads on the Chrome Web Store—complete with a coveted "featured" badge that supposedly marks its compliance with recommended practices (via Sweclockers).

After discovering the extension and taking a closer look at the code, Koi's researchers discovered that FreeVPN.One was silently capturing screenshots exactly 1.1 seconds after any page was loaded, before sending them back to its home server with the page URL, tab ID, and a unique user identifier.

The VPN extension features a "Scan with AI Threat Detection" tool, which, its privacy policy states, may upload screenshots of specific pages and URLs to its secure servers. However, according to the team at Koi, FreeVPN.One was found to be busy taking screenshots of every page well before the tool was deployed, with its users being none the wiser.

It gets worse, too. Koi claims that not only has the VPN been categorising and phoning home geolocation and device data alongside the screenshots in recent months, but the latest version also introduces AES-256-GCM encryption with RSA key wrapping (I only know what some of those words mean), which means the exfiltration of its findings back to its home server is now far harder to detect.

The team at Koi believes the spying behaviour started in April of this year, when a permission update enabled the extension to access every site a user visited. A quick succession of updates over the next few months appears to have further enhanced its permissions access, which Koi characterises as the developer experimenting to see how far they could push the extension without raising suspicion.

The silent screenshot behaviour, along with location tracking and data exfiltration, is said to have begun on July 17. In the next update, the aforementioned encryption was added, along with a switch to a new subdomain.

Koi reached out to the extension's sole developer for comment, who initially responded, denying its findings. The dev claimed that the automatic screenshot capture was part of a background scanning feature and would only trigger if a domain appeared suspicious—but the researchers say they have observed screenshots being captured on a wealth of trusted sites, including Google Sheets and Google Photos.

When asked to provide evidence of legitimacy in the form of a company profile, GitHub account, or LinkedIn page, the team claims the developer stopped responding to their emails, leaving behind one known address that corresponds with a free-tier Wix template page.

Call me an amateur sleuth if you like, but that doesn't seem like the most trustworthy behaviour to me. At the time of writing, FreeVPN.One is still available on the Google Web Store—with a 3.7 star review page now full of angry comments from users referencing Koi's investigation.

Even if the screenshot-snapping behaviour was a legitimate mistake, it seems like the free tool's time in the sun may be over, although the fact that it's still available with the same "featured" badge is troubling. Here's hoping it's soon scoured from the store, with an important lesson learned. Pay for a trustworthy VPN, folks. The free ones usually aren't worth the risk.