6 min read
Counterfeits appear wherever the original disappears. When a popular client is pulled from an app store, the search results fill with lookalikes carrying similar names and near-identical icons within days. The problem isn't the imitation itself — it's that a VPN is software all of your device's traffic passes through, so a fake gets exactly the access it was built to obtain. Here's a two-minute check before installing, and what to do if one is already on your phone.
A VPN client needs network access and permission to create a tunnel configuration. Everything else requires an explanation.
| Android permission | Does a VPN need it | What it can mean | |---|---|---| | Create VPN connection | yes | the standard requirement | | Accessibility services | no | reading everything on screen and acting on your behalf | | SMS and calls | no | intercepting confirmation codes | | Contacts | no | harvesting your address book | | Display over other apps | almost never | overlaying fake input screens | | Autostart and background work | yes | needed for a stable connection |
A VPN app requesting accessibility services is the most serious signal on this list: that permission lets it read whatever is displayed, including the contents of banking apps.
Free keys and configuration files handed out in open channels point to somebody's server. The owner of that server sees which addresses you connect to and is in a position to tamper with DNS responses. The app itself can be entirely genuine — the risk lives in the configuration, not the client.
There's also a technical problem with the clients. In April 2026 a researcher publishing as runetfreedom showed that popular mobile clients built on the xray and sing-box cores open a local proxy with no authentication, so any app on the phone can use it to learn the real address of your VPN server. The Happ client was called out separately for exposing its control interface without authentication — enough to extract a user's configuration including encryption keys, server address and masking parameters. Developers were notified on 10 March 2026; as of the 7 April publication, nothing had been fixed.
A free VPN is still paid for by somebody: servers, bandwidth and traffic cost money. When the user isn't paying, the revenue comes from user data, injected advertising, or selling their connection as an exit node for other people's traffic. The economics are laid out here: free vs paid VPN.
A counterfeit doesn't even have that logic. It isn't planning to operate for long — the goal is to collect installs before it gets pulled.
Full recovery order after a credential leak: your passwords leaked, what to do.
Run the same checks you'd run on anything else. For this service: the developer is an individual entrepreneur, P. A. Onuchin, the site is bessy.my, support runs on the service's own domain, app links are published on the site itself, and the privacy policy lives at bessy.my/docs/privacy. One app covers the whole Apple line, with a separate build for Android TV, and registration is optional.
Install from the links on the site rather than from a store search:
How do I tell a genuine VPN app from a fake? Compare the developer name in the store against the official website, and install via the link from that site rather than through store search.
Are free keys from chat channels dangerous? Yes. The server owner sees which addresses you reach and can tamper with DNS responses. The app itself may be genuine — the configuration is the risk.
Can a VPN app steal my passwords? HTTPS content is encrypted, but an app with accessibility permission reads the screen directly, and encryption doesn't help there.
What if an app asks for accessibility services? Refuse and uninstall. A legitimate VPN client has no use for that permission.
Why do clones target popular clients specifically? They trade on a known name. The spike usually coincides with the original being removed from a store — people go looking for a replacement and take the first lookalike.
Best video calling messengers instead of WhatsApp & Telegram. Review of Zoom, Teams, Signal, FaceTime. Bypass blocks with BessyVPN - bessy.my More
Does a VPN keep logs and what can your ISP see? An honest look at VPN privacy and anonymity. BessyConnect on VLESS+Reality keeps no browsing logs. More
What a DNS leak is and how to run a dns leak test with your VPN on. Learn to check your VPN for leaks and fix them. BessyConnect — a private, leak-free VPN. More
