• Tor unveils Snowflake Volunteer as a standalone Android app
• The app lets users share their open internet connection
• It is the result of a collaboration between Tor and Bloco

The team behind the censorship-resistant Tor Browser has unveiled Snowflake Volunteer — a standalone Android app that lets you help people living in restricted countries bypass internet censorship.

Developed in collaboration with Portuguese Android studio Bloco, the app expands on Snowflake's capabilities. That's Tor’s pluggable transport, which allows people on censored networks to connect to the Tor network via volunteer-operated proxies, making their connection appear as normal traffic.

Since its official launch in April, Tor reported that the app saw an increase from about 1,300 unique proxy IP addresses per day in May to 1,700 per day in June, marking a 29% increase in one month. That represents a win for raising public awareness and expanding its volunteer-led community.

Altruistic digital privacy

Tor Browser is a free-to-use, privacy-focused network that routes Internet traffic through a series of secure computers run by volunteers in different countries — the "layers of an onion" —to prevent snoopers from identifying you personally as the one visiting sensitive sites.

Just like the best VPNs, Tor is all about protecting your privacy online. However, its system only works if people around the world volunteer to run the access points.

Tor bridges, like Snowflake, allow digital users living in safer countries to make their private connections available by turning their phones and computers into proxies, making it appear that they are making video or audio calls. A system that has been widely used as an alternative to VPNs in countries under censorship, including Iran.

It uses the "domain fronting" technique to establish a connection with one of the thousands of Snowflake proxies managed by volunteers. For users subject to censorship, if their Snowflake proxy is blocked, the broker will automatically find a new one.

What Snowflake actually needs is more volunteers' proxies that can serve as disguised access points to the Tor network. Perfectly addressing this need, the Snowflake Volunteer app was created specifically to allow people with less technical experience to easily become these proxies and contribute to the network's continued expansion.

Indeed, until now, the option was available for Android on Orbot, Tor's main Android app, or via browser extensions, a desktop command-line tool, and manual access to Tor's Kindness mode to facilitate the process.

The new app widely simplifies the experience. Users can simply install the app from F-Droid and Google Play (or build it from the source code) and let it run in the background to have their device become part of the Tor bridge. They can also restrict its use to networks with unlimited data, and set a limit on the number of people who can connect at the same time.

Once enabled, the app automatically connects with users seeking a Snowflake proxy and helps route their connection through the Tor network, making it easier and more rewarding to help others online, as people can see the impact of their actions.

Tor vs VPNs?

Is it wise to use a VPN with Tor? Unfortunately, there is no universally accepted answer.

Tor's official stance for most users is not to use a virtual private network (VPN) to avoid the risk of exposing identifying information. However, if you’re an experienced user who understands the technical aspects of VPNs and Tor routing, you could safely opt for more complex configurations.

Others, however, argue we should all use VPNs: particularly in countries with high levels of censorship, some believe it’s better to use VPNs, as they mix better into normal traffic and arouse less suspicion.

Unfortunately, though, this approach fails where VPNs are subject to restrictions or made illegal — further proof that, when it’s about digital security, there might be no one-size-fits-all solution.

• Recorded Future found an Iran-linked group spreading spyware
• The malware is delivered through fake VPN and media player apps
• Researchers assess that most targets are Iranian users

A new report from Recorded Future's Insikt Group describes a campaign that inverts the whole point of a privacy tool: fake VPN apps built specifically to spy on the people who install them.

Researchers have linked fresh infrastructure to an Iran-nexus threat cluster they track as TAG-182, which is using fake VPN and media player downloads to allegedly deliver a surveillance tool called MarkiRAT. The group is "highly likely" to be targeting Iranians living inside and outside the country, the report says.

It's a blunt reminder that choosing one of the best VPN services is a lot more secure than downloading free, unvetted tools.

Fake apps, real surveillance

Insikt Group identified a cluster of attacker-controlled domains allegedly used to stage downloads of applications that appear nowhere on Google Play or Apple's App Store.

Two names stand out: Pis2ray VPN and a media player branded YESHICA, which was quietly renamed YESHICA YEPlayer in March 2026 after researchers publicly exposed the original.

According to researchers, if you download and run one of these files, you get MarkiRAT, a remote access Trojan. In plain terms, that is software that hands control of your device to somebody else.

Analysts have documented it capturing screenshots and uploading them to attacker-run servers, while disguising itself under believable process names.

It also abuses BITS, the background service Windows uses to fetch updates, to pull down further files. Because that activity looks like ordinary system housekeeping rather than an attack, it tends to slip past routine cleanup.

MarkiRAT is not new. It has previously been used by Ferocious Kitten, a group Kaspersky documented conducting years of covert surveillance against activists inside Iran.

Recorded Future stops short of attributing TAG-182 to any specific Iranian agency, but places it within a broader ecosystem of state-aligned surveillance groups.

Why a fake VPN makes such an effective lure

Distribution runs largely through social media. Insikt Group found Instagram posts promoting Pis2ray VPN in the weeks following street protests in Iran in late 2025, and again around the country's prolonged internet shutdown, which ended with partial restoration of access on 26 May 2026.

The people most desperate for a virtual private network (VPN) in a censored country are exactly the people most likely to install one from a social media link, because the official stores are often the very thing they cannot reach.

Recorded Future considers it almost certain that most targets are located in Iran or tied to anti-government movements in Europe and North America. TechRadar has covered previous Iran-linked fake VPN campaigns, and this one seems to follow the same pattern with better infrastructure.

How to stay safe

Most readers will never be targeted by a state actor, but the underlying lesson travels.

Install VPN apps only from official stores, and check that the provider has a real, verifiable presence outside the app listing.

Treat any VPN promoted through an Instagram post, a Telegram channel, or a direct message as suspect, however polished it looks.

Star ratings are a weak signal, since fake reviews are cheap.

• Windscribe said Bill C-22 won't change its privacy policies
• The bill would require service providers to retain user metadata
• Canada's Senate is set to discuss Bill C-22 in September

A Reddit user recently put a blunt question to Windscribe: is paying for a Canada-based VPN a privacy problem, given the surveillance bill working its way through Parliament?

The company's official support account answered without hedging. Windscribe will keep operating exactly as it has, the account said, with "no changes to our logging or privacy policies".

Canada is bringing in laws that genuinely complicate things for the company, Windscribe added, but that is internal work to sort out rather than something subscribers should expect to feel.

It's a calmer message than the one Windscribe was broadcasting in May, when it said it would sooner relocate its headquarters than start logging users. That put it alongside Signal and NordVPN, and made it one of the sharpest voices among the best VPN providers fighting the bill.

Bill C-22, formally the Lawful Access Act, cleared the House of Commons on June 18 and now sits with the Senate, which won't begin its study until Parliament returns in September.

Windscribe and Bill C-22: what the VPN provider said

Is paying for Windscribe a problem to privacy given they’re based in Canada and the likely upcoming Bill C-22? Would love to subscribe if not for this. from r/Windscribe

Pressed further in the thread, Windscribe drew a line between where the company is registered and where its infrastructure lives.

The incoming laws could see it served with a court order requiring it to start logging users, the support account acknowledged. Its answer is jurisdictional: a virtual private network (VPN) operating outside Canada doesn't have to comply with Canadian law.

That echoes the route the company has been signalling since May, when CEO Yegor Sak told the Globe and Mail he was actively exploring moving Windscribe out of the country.

Windscribe was also careful to separate provider obligations from user liability. No law currently stops Canadians from using a VPN, it pointed out, and the risk it describes only reaches customers if a provider stays put and starts logging traffic.

For anyone uneasy about the paper trail, Windscribe's suggestion was simple: pay in crypto, so neither the government nor a card issuer sees the purchase.

What's next for Canada Bill C-22

Introduced in March by Public Safety Minister Gary Anandasangaree, Canada Bill C-22 would let the government compel electronic service providers to retain user metadata and build technical capabilities for law enforcement access.

The House passed it at third reading on June 18 after the government moved to limit debate, and the Senate is set to pick it up on September 21, according to Parliament's own LEGISinfo tracker.

Late amendments cut the maximum metadata retention period from twelve months to six and added a clause stating the act can't be read as compelling decryption, unless the provider already holds the keys.

Still, law professor Robert Diab argues that doesn't go far enough, since ministerial orders could still sweep up the metadata of people under no suspicion whatsoever.

The government has consistently rejected the surveillance framing, insisting the bill builds no backdoors and that authorities still need judicial authorisation to obtain data.

• Past breach data show over 1.1 million soccer-related passwords
• ExpressVPN found that nearly 1 in 4 football fans use this info in their logins
• Experts urge to delete any sports references from account logins' details

As the FIFA World Cup kicks into high gear, millions of fans are displaying their loyalty online. While you might already be using the best VPN to secure your browsing, ExpressVPN — now an official supporter of the 2026 tournament — is warning that this very public fandom can translate into a major cybersecurity vulnerability.

In a new research report, cybersecurity researcher Jeremiah Fowler partnered with ExpressVPN to examine how soccer obsession influences our password choices. The results suggest that fans are openly handing hackers the keys to their digital lives by using highly predictable phrases.

Fowler's analysis of historical data breaches revealed more than 1.1 million soccer-related passwords. Words like "soccer," alongside massive club names such as "Liverpool," "Chelsea," "Arsenal," and "Barcelona," appeared repeatedly throughout the dataset.

Because fan loyalty is incredibly public, plastered across social media profiles, usernames, and group chats, these passwords are far easier to crack than a random string of characters.

"As a cybersecurity researcher, I've seen criminals target people through the interests they share most openly," Fowler explained. "A club name, player nickname, shirt number, stadium, city, or tournament year may look harmless on its own, but together those details can help someone guess how a fan might build a password or craft a message they're more likely to trust."

An open goal for cybercriminals

To determine if this behavior remains common today, ExpressVPN surveyed 6,000 football fans across six countries. The findings confirm that bad password hygiene is still widespread.

Nearly one in four surveyed fans admitted to having used soccer-related information to secure an account.

Among these fans, the most common choices included their favorite team names, player names or nicknames, and jersey numbers. These easily searchable statistics are exactly what malicious actors look for when compiling custom dictionaries to breach an account.

The fans themselves are surprisingly aware of the risk. In the US, a massive 73.1% of those using soccer-themed passwords acknowledged that someone familiar with their sporting interests could likely guess their login.

This vulnerability is compounded by the fact that many fans are already putting their digital privacy at risk through other careless online behaviors during the tournament.

How to protect your accounts

Using a weak password becomes catastrophic when you consider password reuse. According to Aaron Engel, Chief Information Security Officer at ExpressVPN, the habit of using the same login across multiple services is what turns a minor breach into a full-scale privacy crisis.

"Password reuse is what allows one exposed credential to become a wider account-security problem," warned Engel.

He also noted that fans who share streaming logins put their personal data in further jeopardy: "Sharing passwords increases the number of people and devices that may hold that password; in doing so, users are putting their security into the hands of others. Multi-factor authentication doesn't undo reuse, but it can prevent a stolen password from being enough on its own."

If you want to stay safe while streaming the tournament, you should immediately strip any sports references out of your logins. Instead, use a dedicated password manager to generate complex, unique credentials for every account.

It is also a great time to ensure your overall connection is encrypted, particularly if you are wondering whether to use a VPN to watch the World Cup.

Just keep in mind that new ExpressVPN users still have a chance to win a premium ticket for the World Cup, but you won't get its usual 30-day money-back guarantee.

Traveling to the 2026 World Cup means joining hundreds of thousands of fans in crowded cities across North America.

Airports, stadiums, fan zones, and hotels are all packed with people competing for the same public Wi-Fi networks. These connections are often slow and insecure, making personal data vulnerable to interception.

To stay protected without sacrificing speed, you need more than just a VPN – you need the best VPN with the right settings. Tuning your VPN configuration helps keep your connection secure and fast, no matter where you go during this summer’s tournament.

The 5 best settings to change for top VPN performance

Just turning on your VPN isn’t always enough to cut through the noise of a packed stadium or busy airport terminal. To get good speeds and real security when thousands of people are online at once, here are five specific settings to tweak:

1. Protocol

WireGuard is the superior protocol choice for modern devices, offering faster connection speeds and lower latency compared to OpenVPN or IKEv2.

This efficiency matters when network congestion is high. WireGuard establishes secure tunnels more quickly, reducing wait times. If your provider offers OpenVPN, it's a great alternative for compatibility, but for raw performance in crowded zones, WireGuard is best.

2. Transport protocol

If you've never heard of transport protocols before, think of them as the delivery method your VPN uses to move data. Most commonly, you'll see TCP and UDP as your choices for this.

On congested networks, TCP’s reliability mechanisms can add delay when packets are lost. UDP avoids this overhead by sending data without waiting for confirmation.

In a crowded stadium where every millisecond counts, switching to UDP can reduce latency and improve responsiveness for smooth VPN streaming even when the network is struggling to keep up.

3. Split tunnelling

With split tunneling, you can choose which apps can be routed outside the VPN’s encrypted tunnel. At a stadium, your banking app needs maximum security, but a local map app might benefit from direct access to avoid unnecessary latency.

Excluding non-sensitive apps from encryption can reduce bandwidth strain and prevent compatibility issues with local networks that sometimes block VPN traffic entirely.

4. Location

Connecting to the server closest to your physical location often results in lower ping and faster speeds. However, nearby servers may be overwhelmed by thousands of users connecting simultaneously.

If your current location lags, try switching to a server slightly further away that’s under less user load. Avoid jumping between regions unnecessarily, as crossing international borders increases the distance data travels and introduces lag that ruins live streaming.

5. Obfuscation

In monitored environments like airports, deep packet inspection can detect and block standard VPN traffic.

Obfuscation disguises VPN traffic as regular HTTPS web traffic, allowing you to bypass firewalls and censorship attempts. Although this adds processing that might marginally impact speed, the ability to stay connected when other connections fail more than makes up for this.

As you prepare to cheer on your national team at the 2026 FIFA World Cup, make sure your setup can handle the packed stadiums and busy airports.

By selecting the right VPN protocol, using UDP, and enabling features like split tunneling, you can protect your data and keep your device safe so you can enjoy the World Cup worry-free..