Spyware found stealing Iranian user data via infected VPN installer

Hand holding a smartphone with a VPN logo on screen, the Iran's flag on the background
(Image credit: Shutterstock)

Spyware has been discovered stealing Iranian users data via an infected VPN installer, antivirus provider Bitdefender has revealed. 

The company's joint-research with cybersecurity firm Blackpoint found components of Iranian-made EyeSpy malware to be injected "through Trojanized installers of VPN software (also developed in Iran)."  

The majority of targets were within the country's borders, only a few victims were found to be based in Germany and the US. 

This is particularly concerning in a country like Iran, where using one the best VPN services has increasingly become a necessity. Whether this is for bypassing its strict online censorship, or preserving anonymity to avoid dangerous government surveillance. Most likely, a mix of both.  

At the same time, a harsh crackdown on Iranian VPN services might push people towards unsecure third-party vendor sites. This makes such a spyware campaign even more dangerous for Iranians' privacy and security.    

Anti-dissident spware?

"In light of the recent events, it’s possible that the targets are Iranians who want to access the internet via a VPN to bypass the country’s digital lockdown. Such malicious installers could plant spyware on people who pose a threat to the regime," Bitdefender's report noted. 

Developed by Iranian-based firm SecondEye, EyeSpy is a legit monitoring software sold to businesses as a way to monitor employees' activities working remotely.  

The attackers were observed using components of the legit application in a malicious way to infect users' downloading the Iranian-based VPN service 20Speed and spy on their activities.     

Once injected into a device, the malware can virtually spy on every activity and collect a tons of sensitive data. These include stored passwords, crypto-wallet data, documents and images, contents from clipboard, and logs key presses. 

"The components of the malware are scripts that steal sensitive information from the system and upload them to an FTP server belonging to SecondEye," Bitdefender explained.

"This can lead to complete account takeovers, identity theft and financial loss. Moreover, by logging keypresses, attackers can obtain messages typed by the victim on social media or e-mail, and this information can be used to blackmail the victims." 

The campaign appears to be active since May 2022, with a growing number of attacks following the wave of anti government protests began in September.  

VPN downloads in Iran skyrocketed following this, reaching a peak of more than 3,000% increase by the end of the month. 

A VPN is largely used by Iranian citizens to access restricted apps like Instagram and WhatsApp. But, as the government increasingly charges dissidents with harsh sentences even reaching the death penalty, extra security software is also a necessity to safeguard sensitive data.

While more and more Iranians download a virtual private network on their devices, authorities are hardly cracking down on reliable VPN services as a result. 

Many providers are currently blocked in Iran, meaning that third-party VPN installers are increasingly in popularity. According to Iran International, 20Speed VPN is actually one of the most popular websites where Iranians head to buy their VPN subscriptions. Over 100,000 are the active installations of its Android VPN app.

To fight against such malware campaigns, Bitdefender's experts recommend "using well-known VPN solutions downloaded from legitimate sources. Also, a security solution, like Bitdefender, can protect against information stealers."

Chiara Castro
News Editor (Tech Software)

Chiara is a multimedia journalist committed to covering stories to help promote the rights and denounce the abuses of the digital side of life – wherever cybersecurity, markets, and politics tangle up. She writes news, interviews, and analysis on data privacy, online censorship, digital rights, cybercrime, and security software, with a special focus on VPNs, for TechRadar and TechRadar Pro. Got a story, tip-off, or something tech-interesting to say? Reach out to chiara.castro@futurenet.com

Read more
Computer Hacked, System Error, Virus, Cyber attack, Malware Concept. Danger Symbol
China-linked cyberespionage group PlushDaemon used South Korean VPN service to inject malware
malware
Google warns of legit VPN apps being used to infect devices with malware
 In this photo illustration a Google Play logo seen displayed on a smartphone.
Why is there so much spyware hidden in the Play Store?
VPN world map
119 countries saw VPN usage soar in 2024 during times of political crisis
Woman hands and flag of Venezuela on computer, laptop keyboard
After TikTok, Venezuela blocks VPN websites
 laptop with warning symbol on desk
Experts predict malware may impact 39% of free Android VPNs by 2025 – but that's not the only worry
Latest in VPN Privacy & Security
Close up of PS5 DualSense controller leaning on a PS5
5 reasons your PS5 needs a VPN
Tor
What is Onion over VPN?
 In this photo illustration a Google Play logo seen displayed on a smartphone.
Why is there so much spyware hidden in the Play Store?
PrivadoVPN running on an iPhone during TechRadar's VPN tests
Why PrivadoVPN Free is still the best free VPN for streaming
Homepage of CloudFlare website on the display of PC, url - CloudFlare.com.
"Network blocking is never going to be the solution" – Cloudflare slams anti-piracy tactics
Panels at RightsCon 2025 during a press briefing about the latest Access Now report of internet shutdowns
2024 was the worst year on record for internet freedoms – again
Latest in News
Image showing detail of the Leica D-Lux 8
Still can't get a Fujifilm X100VI? This premium Leica compact costs less, and it's in stock
Man using iMessage on an iPhone
Apple will finally enable encrypted RCS messages between iOS and Android, and it's about time
Jason Sudeikis' Ted Lasso pointing at someone in Ted Lasso season 2
Believe it, baby: Ted Lasso season 4 is officially in development for Apple TV+ and Jason Sudeikis will reprise his role as the titular soccer coach
Quordle on a smartphone held in a hand
Quordle hints and answers for Saturday, March 15 (game #1146)
NYT Strands homescreen on a mobile phone screen, on a light blue background
NYT Strands hints and answers for Saturday, March 15 (game #377)
NYT Connections homescreen on a phone, on a purple background
NYT Connections hints and answers for Saturday, March 15 (game #643)