• ExpressVPN has replaced its Aircove router with Fortify, a faster Wi-Fi 6 model built on GL.iNet's Flint 2 platform
• For $199.99, you get the Fortify router and 12 months of ExpressVPN's Advanced plan
• Aircove and Aircove Go are retiring from sale, but existing owners keep support and qualify for a Fortify discount

ExpressVPN, regularly ranked among the best VPN providers, has announced Fortify, a new Wi-Fi 6 VPN router that takes over from its Aircove line and shifts the company's router-level protection onto hardware built by networking specialist GL.iNet.

The idea is a familiar division of labour: GL.iNet supplies the hardware, firmware, and router interface, while ExpressVPN brings the VPN service and privacy technology as part of what both companies describe as a longer-term partnership.

Zac Eller, GM of Global Partnerships at ExpressVPN, says that "together we can do more for customers than either of us would alone."

The launch also draws a line under Aircove. ExpressVPN is retiring both Aircove and the portable Aircove Go from sale, positioning Fortify as the upgrade path for anyone who wants router-level ExpressVPN on more capable hardware.

ExpressVPN Fortify: a big step up from Aircove

Fortify is a dual-band Wi-Fi 6 AX6000 router, a clear jump from Aircove's AX1800 rating. It uses a 4x4 MU-MIMO layout, up from 2x2, and tops out at 1148 Mbps on the 2.4GHz band and 4804 Mbps on 5GHz.

Inside sits a quad-core 2.0GHz processor with 1GB of DDR4 memory and 8GB of eMMC storage, alongside two 2.5 Gigabit Ethernet ports and four Gigabit LAN ports for multi-gig home setups.

For VPN users, speed is the real draw. ExpressVPN says Fortify handles VPN throughput of up to 900 Mbps on WireGuard, compared with up to 330 Mbps on Aircove, and supports as many as 86 devices at once.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

How Fortify works, and what's included

As with Aircove, Fortify runs the VPN at the router level, so every supported device on the network can be routed through ExpressVPN, including smart TVs, game consoles, security cameras, and other gadgets that cannot install a VPN app of their own.

The connection uses the WireGuard protocol at launch and is configured through GL.iNet's router interface, which retains the platform's networking tools such as Multi-WAN failover, Smart Queue Management, and AdGuard Home for network-wide ad and tracker blocking.

Fortify ships with 12 months of ExpressVPN's Advanced plan (a value of $119.95) for both new and returning users. That covers the VPN through the router as well as ExpressVPN's apps on personal devices. It also bundles extras including the ExpressKeys password manager, ad and tracker blocking, ExpressMailGuard, and more.

On trust, ExpressVPN points to its no-logs policy and RAM-only TrustedServer infrastructure, independently audited by firms including PwC, Cure53 and KPMG. Aircove also passed a Cure53 security audit at launch.

Fortify goes on sale from GL.iNet's website on September 16 at an MSRP of $199.99.

What Aircove owners need to know

ExpressVPN's router journey began in 2016 with dedicated router firmware, followed by the first Aircove in 2022 and the portable Aircove Go in 2024. Both are now being retired, and ExpressVPN will not produce any more units.

If you already own one, there's nothing to do right now. Existing routers keep working, and ExpressVPN says critical security updates and customer support will continue through 2027 for Aircove and through 2028 for Aircove Go.

There's also an incentive to upgrade: existing Aircove and Aircove Go owners qualify for 20% off Fortify. To claim it, contact ExpressVPN Customer Support to confirm ownership and receive a discount code.

• Nearly half of the top mobile apps collect your browsing history
• Social media apps are the worst offenders
• Avoiding in-app browsers can limit data collection

You probably assume your web browser is the only app keeping tabs on where you go online. According to new research from Surfshark, that assumption is incorrect.

The cybersecurity firm analyzed 40 of the most popular Android and iOS apps and found that 18 of them, or 45%, report collecting users' browsing history in their app store privacy labels. In other words, nearly half of the apps you open every day may be logging the websites you visit.

Even the best VPN cannot fully stop an app from recording what you do inside its own walls, which makes understanding what you are signing up for more important than ever.

What Surfshark found

Surfshark's team looked at 40 leading apps split evenly across four categories: generative AI, social media, e-commerce, and messaging.

For each one, the researchers checked whether its Apple App Store label reported collecting "Browsing History" and whether its Google Play label reported "Web Browsing History."

Social media came out as the biggest collector by far. Nine of the 10 social apps studied collect browsing history on at least one platform. Facebook, Instagram, TikTok, X, YouTube, and Pinterest do so on both Android and iOS, while Reddit, LinkedIn, and Snapchat collect it on Android only. Discord was the only social app that collected it on neither.

E-commerce came next, with half of the shopping apps analyzed collecting the data on at least one platform.

Messaging was less hungry, with only Rakuten Viber, Messenger, and LINE gathering it, echoing earlier findings on how much data messaging apps collect.

In the generative AI category, Google Gemini was the only app of the 10 to report collecting browsing history.

NEW: Leave No Trace — A weekly newsletter on digital privacy and online surveillance.

Leave No Trace investigates the companies and governments putting our digital freedom at risk — and the people fighting back.

📩 Subscribe now to get every edition delivered to your inbox every Friday, launching this September.

Why apps want your browsing history

The logic is straightforward: the more an app knows about where you go online, the more precisely it can target ads and shape the content in your feed.

As Surfshark's lead system engineer Karolis Kaciulis explains, many apps now route external links through their own "embedded browsers," so the moment you tap a link, they can track what you search for and look at.

The important thing to remember here is that most of these social media and shopping apps do not need your browsing history to provide their services. The practice is not related to providing value to users, and simply takes place to benefit the app companies.

Kaciulis argues that consent for this is usually buried in the fine print, and that the apps fighting hardest to keep you inside their own browser tend to be the ones selling ads rather than the ones that need your history to function.

How to stay safe

There is no single switch that turns all of this off, but a few habits can go a long way.

The easiest is to sidestep in-app browsers: when you tap a link, use the "Open in default browser" option or paste the URL into your default browser, which stops the host app from watching where you go next.

Pair this with switching to a privacy-focused browser, and you'll be able to avoid a lot of the worst data-collecting practices without much effort.

• Recorded Future found an Iran-linked group spreading spyware
• The malware is delivered through fake VPN and media player apps
• Researchers assess that most targets are Iranian users

A new report from Recorded Future's Insikt Group describes a campaign that inverts the whole point of a privacy tool: fake VPN apps built specifically to spy on the people who install them.

Researchers have linked fresh infrastructure to an Iran-nexus threat cluster they track as TAG-182, which is using fake VPN and media player downloads to allegedly deliver a surveillance tool called MarkiRAT. The group is "highly likely" to be targeting Iranians living inside and outside the country, the report says.

It's a blunt reminder that choosing one of the best VPN services is a lot more secure than downloading free, unvetted tools.

Fake apps, real surveillance

Insikt Group identified a cluster of attacker-controlled domains allegedly used to stage downloads of applications that appear nowhere on Google Play or Apple's App Store.

Two names stand out: Pis2ray VPN and a media player branded YESHICA, which was quietly renamed YESHICA YEPlayer in March 2026 after researchers publicly exposed the original.

According to researchers, if you download and run one of these files, you get MarkiRAT, a remote access Trojan. In plain terms, that is software that hands control of your device to somebody else.

Analysts have documented it capturing screenshots and uploading them to attacker-run servers, while disguising itself under believable process names.

It also abuses BITS, the background service Windows uses to fetch updates, to pull down further files. Because that activity looks like ordinary system housekeeping rather than an attack, it tends to slip past routine cleanup.

MarkiRAT is not new. It has previously been used by Ferocious Kitten, a group Kaspersky documented conducting years of covert surveillance against activists inside Iran.

Recorded Future stops short of attributing TAG-182 to any specific Iranian agency, but places it within a broader ecosystem of state-aligned surveillance groups.

Why a fake VPN makes such an effective lure

Distribution runs largely through social media. Insikt Group found Instagram posts promoting Pis2ray VPN in the weeks following street protests in Iran in late 2025, and again around the country's prolonged internet shutdown, which ended with partial restoration of access on 26 May 2026.

The people most desperate for a virtual private network (VPN) in a censored country are exactly the people most likely to install one from a social media link, because the official stores are often the very thing they cannot reach.

Recorded Future considers it almost certain that most targets are located in Iran or tied to anti-government movements in Europe and North America. TechRadar has covered previous Iran-linked fake VPN campaigns, and this one seems to follow the same pattern with better infrastructure.

How to stay safe

Most readers will never be targeted by a state actor, but the underlying lesson travels.

Install VPN apps only from official stores, and check that the provider has a real, verifiable presence outside the app listing.

Treat any VPN promoted through an Instagram post, a Telegram channel, or a direct message as suspect, however polished it looks.

Star ratings are a weak signal, since fake reviews are cheap.

• Windscribe said Bill C-22 won't change its privacy policies
• The bill would require service providers to retain user metadata
• Canada's Senate is set to discuss Bill C-22 in September

A Reddit user recently put a blunt question to Windscribe: is paying for a Canada-based VPN a privacy problem, given the surveillance bill working its way through Parliament?

The company's official support account answered without hedging. Windscribe will keep operating exactly as it has, the account said, with "no changes to our logging or privacy policies".

Canada is bringing in laws that genuinely complicate things for the company, Windscribe added, but that is internal work to sort out rather than something subscribers should expect to feel.

It's a calmer message than the one Windscribe was broadcasting in May, when it said it would sooner relocate its headquarters than start logging users. That put it alongside Signal and NordVPN, and made it one of the sharpest voices among the best VPN providers fighting the bill.

Bill C-22, formally the Lawful Access Act, cleared the House of Commons on June 18 and now sits with the Senate, which won't begin its study until Parliament returns in September.

Windscribe and Bill C-22: what the VPN provider said

Is paying for Windscribe a problem to privacy given they’re based in Canada and the likely upcoming Bill C-22? Would love to subscribe if not for this. from r/Windscribe

Pressed further in the thread, Windscribe drew a line between where the company is registered and where its infrastructure lives.

The incoming laws could see it served with a court order requiring it to start logging users, the support account acknowledged. Its answer is jurisdictional: a virtual private network (VPN) operating outside Canada doesn't have to comply with Canadian law.

That echoes the route the company has been signalling since May, when CEO Yegor Sak told the Globe and Mail he was actively exploring moving Windscribe out of the country.

Windscribe was also careful to separate provider obligations from user liability. No law currently stops Canadians from using a VPN, it pointed out, and the risk it describes only reaches customers if a provider stays put and starts logging traffic.

For anyone uneasy about the paper trail, Windscribe's suggestion was simple: pay in crypto, so neither the government nor a card issuer sees the purchase.

What's next for Canada Bill C-22

Introduced in March by Public Safety Minister Gary Anandasangaree, Canada Bill C-22 would let the government compel electronic service providers to retain user metadata and build technical capabilities for law enforcement access.

The House passed it at third reading on June 18 after the government moved to limit debate, and the Senate is set to pick it up on September 21, according to Parliament's own LEGISinfo tracker.

Late amendments cut the maximum metadata retention period from twelve months to six and added a clause stating the act can't be read as compelling decryption, unless the provider already holds the keys.

Still, law professor Robert Diab argues that doesn't go far enough, since ministerial orders could still sweep up the metadata of people under no suspicion whatsoever.

The government has consistently rejected the surveillance framing, insisting the bill builds no backdoors and that authorities still need judicial authorisation to obtain data.