Cleafy's report highlights the dangerous Klopatra malware disguised as a free VPN app, Mobdro Pro IP + VPN. This malware exploits the increasing popularity of VPNs, particularly in response to restrictive laws and streaming service fragmentation. Klopatra tricks users into granting complete device control through a fake installation wizard. Once installed, it uses accessibility services to steal banking credentials and enlist devices in a botnet. The malware has already infected around 3,000 devices, primarily in Italy and Spain. Cleafy suspects the perpetrators are based in Turkey and are adapting their tactics. The choice of a fake VPN app capitalizes on user demand for bypassing geo-restrictions. Kaspersky previously warned about this trend, identifying additional malicious free VPNs like MaskVPN and PaladinVPN. Given Klopatra's success, copycats are expected to emerge. Users should carefully vet any free VPN apps before installation. For security, consider using reputable free VPN options like Proton VPN or hide.me instead of unknown alternatives.