If you happen to have downloaded a VPN app on your phone in recent months, you might want to check where it’s come from. Security experts are warning that Android users are being targeted by a scary new threat that’s using a fake VPN service to infect devices with a very nasty type of malware called Klopatra.
Once this vicious bug has made its way onto a phone, it can be used by hackers to capture inputs, monitor the victim’s screen and even simulate taps and swipes. That means crooks could easily log into email and bank accounts without the phone owner ever knowing anything is wrong.
Another scary feature of Klopatra is something called a black-screen VNC mode. This allows online thieves to perform actions on the infected device while it appears to the victim that the screen is idle and locked.
It’s a worrying new threat that should not be ignored. Luckily, this new attack will only happen if the VPN is side-loaded from the internet – applications found on Google’s Play Store are not impacted.
According to the cyber experts at Cleafy, the app everyone needs to watch out for is called Modpro IP TV + VPN.
“The initial phase of the attack relies on a dropper application, a lure designed to appear legitimate and desirable. In this case, the dropper masquerades as an IPTV application called “Mobdro Pro IP TV + VPN,” promising access to high-quality television channels,” Cleafy explained.
“This choice is not accidental; pirated streaming applications are very popular, and users are often willing to install them from unofficial sources, bypassing the protections of the Google Play Store.”
Evidence gathered by Cleafy suggests that thousands have already been compromised with most of the attacks happening in Europe.
Cleafly also states that since March 2025, when Klopatra first appeared in the wild, there have been 40 distinct builds, a sign of active development and quick evolution for the new Android trojan.
It’s now vital that anyone with an Android phone thinks carefully before side-loading any applications onto their device. Those who think they’ve downloaded a VPN via the web might be wise to delete it and reset their device.