Short answer: A cracked VPN is pirated or modified VPN software, and installers like that are a known way to deliver malware. Microsoft’s security team says cracked or pirated versions of legitimate applications are bundled with the Lumma Stealer, an information stealer, and distributed through file-sharing platforms. A VPN handles all your traffic, so it is one of the worst apps to take from an unofficial source.
We did not download or run any cracked VPN, and we do not claim our own malware findings. This page relies on published security research. Checked October 5, 2026.
What people mean by a cracked VPN
- a modified Android app file (a mod APK) that unlocks paid features
- a patched Windows or macOS installer that skips the license check
- a shared or generated premium account found on forums or messaging apps
VPN APK mod: why it is not safe and why pirated NordVPN apps are risky cover the Android side in more detail.
How malware travels inside cracked software
Microsoft’s analysis of Lumma Stealer lists several distribution routes, including phishing, malvertising and drive-by downloads. It also says that in many campaigns cracked or pirated versions of legitimate applications are bundled with Lumma binaries and shared through file-sharing platforms, and that these modified installers often show no visible sign of the payload during installation, running the malware silently after launch.
Trend Micro published an analysis of infections that began with fake installers and cracks, which shows the same pattern from a different security vendor. Search-engine ads and cloned download sites are common places where these files are found.
Why a VPN is a bad place to take that risk
A VPN client runs with deep access to your network connection and, by design, sees or relays all your traffic. A tampered VPN app asks you to trust an unknown party with exactly that position. An information stealer such as Lumma goes after saved browser passwords and similar data, which is why infection through a cracked installer can lead to account takeover rather than just a broken app. Infostealer malware: how it steals passwords explains how that works.
Other costs that are not malware
- No support or updates. A cracked app does not receive the provider’s security updates.
- Terms and legal risk. Using pirated software breaks the provider’s license terms and may break copyright law where you live.
- Broken promises. A VPN’s value depends on a trusted operator. A cracked copy comes without any.
Safer ways to get a VPN without paying a lot
Use a free tier from an accountable provider rather than a stolen premium one. Are free VPNs safe? explains how to tell the difference and notes Proton VPN’s free plan as a documented exception. Many paid providers offer money-back guarantees, and Mullvad charges a flat price per month. Check the guarantee terms before you pay, because they vary by provider and payment method. For how we compare providers, see our VPN comparison.
If you already installed one
- Disconnect the device from the internet and stop using it for sensitive accounts.
- Uninstall the app and run a full scan with a reputable antivirus. VirusTotal can check a file against many engines, but a clean result does not prove a file is safe.
- From a clean device, change the passwords for important accounts, starting with email and banking, and turn on two-factor authentication.
- If the device is a work device, tell your IT team.
What Android does about apps from outside the Play Store
Google Play Protect scans apps on Android, and Google’s help page says it checks apps that were installed from outside Google Play too. It may recommend that you scan an app it has never seen, which sends the app’s details to Google for evaluation. It warns about potentially harmful apps, may deactivate or remove them, and runs a lightweight scan daily, with a full scan available at any time. Google also says it may block installation of an unverified app that asks for sensitive permissions often used in financial fraud.
That is a useful safety net, but it is not a guarantee. Protection can miss new or tampered files, and a VPN app asks for the permissions it needs to work by design. Do not treat a clean scan as permission to install a file from an unofficial source.
Warning signs
- A download offered through a search ad or a file-sharing site instead of the provider’s own site or an official app store, a route Microsoft names for malware campaigns.
- A “premium unlocked” or “no license needed” label from someone who is not the provider.
- A file name that is a close variation of a real app, or an installer that asks you to switch off your antivirus.
- A “free premium account” shared on a forum or messaging group.
Frequently asked questions
Are all cracked VPNs infected?
We cannot say what share is, and we did not test any. Security vendors report that cracked software is a common malware route, and you have no way to verify a given file.
Is a cracked VPN safer than no VPN?
Not if it carries malware or tampered code. A trustworthy free VPN is a better choice.
Can antivirus detect a cracked VPN?
Sometimes. Detection is not guaranteed, especially for new variants.