A new study alleges that 18 popular Android VPN apps, collectively downloaded over 700 million times, are secretly connected in three distinct families despite claiming independence. These VPNs, including well-known services like Turbo VPN and X-VPN, failed to disclose their behind-the-scenes relationships. The research, published in the Privacy Enhancing Technologies Symposium, also uncovered serious security flaws within their shared infrastructures. Specifically, the identified VPNs are vulnerable to attacks that could expose user browsing activity and inject malicious data. The study was inspired by prior investigations into VPN companies selling multiple apps without revealing connections. Researchers systematically analyzed business paperwork, web presence, and codebases to identify these hidden links, primarily through code similarities. Family A includes Turbo VPN and VPN Proxy Master, linked to providers associated with Qihoo 360, a Chinese firm designated as a "Chinese military company." Family B encompasses eight VPNs sharing the same IP addresses from a single hosting company. Family C consists of X-VPN and Fast Potato VPN, which, despite different providers, utilize very similar code and a custom VPN protocol. This lack of transparency about ownership and origin, coupled with critical security vulnerabilities like hard-coded passwords in their Shadowsocks protocol, indicates a design prioritizes data collection over user safety. The study emphasizes the necessity of thoroughly vetting free VPNs and recommends opting for those supported by paid subscriptions.