A Google-featured VPN extension is reportedly carrying out suspicious activities that may compromise the security and privacy of its users.
In a new blog post, the cybersecurity firm Koi Security says that the Chrome extension FreeVPN.One has been silently accessing and capturing screenshots of the pages that users visit.
Says the firm,
“Seconds after any page loads, a background trigger grabs a screenshot and sends it to aitd[.]one/brange.php, bundled with the page URL, tab ID, and a unique user identifier. No user action, no UI hint, the screenshots are taken in the background without you ever knowing.”
Koi Security says the extension behaved like a basic VPN tool for years, but something changed following several updates that the developer rolled out this year. The updates included an “AI Threat Detection” that the firm says enabled broader access to websites.
“On May 31, 2025, the domain aitd.one was registered. A month later, v3.1.3 shipped, and the spying went live.
- Silent screenshots on every site
- Collection began, tracking your location and harvesting your device details
- Data exfiltration commenced, sending everything to the new aitd.one servers.”
Koi Security says the VPN service’s behavior poses risks to users, and its screenshots can sweep “passwords, banking details, personal messages, and any sensitive data rendered on your screen.”
“These images are then uploaded to a third-party server separate from the VPN provider, an exfiltration path entirely opposed with what a privacy tool should do.”
Read the full Koi Security report here.
Follow us on X, Facebook and Telegram
Don't Miss a Beat – Subscribe to get email alerts delivered directly to your inbox
Check Price Action
Surf The Daily Hodl Mix
Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.
Generated Image: Midjourney
