Hidden VPN App Families Expose Users via Shared Secrets and Ownership Deception

A recent research study analyzed large families of Android VPN apps (collectively exceeding 700 million Google Play downloads) that mask shared ownership and reuse insecure components. The apps were found to embed hard-coded Shadowsocks passwords and rely on deprecated ciphers, which can enable traffic decryption and negate claimed privacy protections; because provider identities and insecure components are reused across many apps, a compromise of one app or component could put a vast user base at risk.