There are some very good and obvious reasons why a VPN should be part of your summer holiday plans.

Anyone who's ever had to rely on crawling hotel Wi-Fi speeds or faced blocks on their regular home streaming services while abroad will understand the frustration, and a VPN is a great solution for both of those.

A VPN will mask your online activities to make sure you can access whatever you like on public Wi-Fi without the network restricting your bandwidth or recording the sites and services you go to.

You can also use a VPN to supply you with an IP address of any country in the world, of course. That means that your device can appear to be connecting from back home and you won't get blocked from accessing iPlayer, Sling or any of your other regular streamers.

All good VPNs offer these things, and for a few dollars a month, it's well worth downloading one for this year's summer vacation.

If you are going to give that a try, then you should have a think about IPVanish. It's a very good VPN – not the best VPN, but a very good one – but the reason it's a good choice for your travels this time is that an IPVanish subscription currently comes with a free eSIM to use for 30 days too.

Compare that to ExpressVPN – the only other recommended VPN company that offers a free eSIM right now. First, ExpressVPN's plans are twice as expensive ($2.19 per month vs $4.49 per month) but, secondly, you only get access to your eSIM for 3 days with ExpressVPN!

Sign up to the IPVanish Essential plan ($2.19 per month) and you'll get 3GB for 30 days. If you go for the Advanced plan ($3.29 per month), then it's 5GB for 30 days.

The other good reason to try Advanced is that it comes with access to a cloud based browser called Secure Browser. This means that you'll do all your browsing and service accessing from IPVanish's cloud servers, instead of your own device, while on shared Wi-Fi networks. There's no way that any restricting network will have any idea of what you're doing and that should mean you're scot-free to access whatever you need with minimal disruptions.

You can read more about IPVanish and Secure Browser here. Have a great vacation and happy travels!

• Recorded Future found an Iran-linked group spreading spyware
• The malware is delivered through fake VPN and media player apps
• Researchers assess that most targets are Iranian users

A new report from Recorded Future's Insikt Group describes a campaign that inverts the whole point of a privacy tool: fake VPN apps built specifically to spy on the people who install them.

Researchers have linked fresh infrastructure to an Iran-nexus threat cluster they track as TAG-182, which is using fake VPN and media player downloads to allegedly deliver a surveillance tool called MarkiRAT. The group is "highly likely" to be targeting Iranians living inside and outside the country, the report says.

It's a blunt reminder that choosing one of the best VPN services is a lot more secure than downloading free, unvetted tools.

Fake apps, real surveillance

Insikt Group identified a cluster of attacker-controlled domains allegedly used to stage downloads of applications that appear nowhere on Google Play or Apple's App Store.

Two names stand out: Pis2ray VPN and a media player branded YESHICA, which was quietly renamed YESHICA YEPlayer in March 2026 after researchers publicly exposed the original.

According to researchers, if you download and run one of these files, you get MarkiRAT, a remote access Trojan. In plain terms, that is software that hands control of your device to somebody else.

Analysts have documented it capturing screenshots and uploading them to attacker-run servers, while disguising itself under believable process names.

It also abuses BITS, the background service Windows uses to fetch updates, to pull down further files. Because that activity looks like ordinary system housekeeping rather than an attack, it tends to slip past routine cleanup.

MarkiRAT is not new. It has previously been used by Ferocious Kitten, a group Kaspersky documented conducting years of covert surveillance against activists inside Iran.

Recorded Future stops short of attributing TAG-182 to any specific Iranian agency, but places it within a broader ecosystem of state-aligned surveillance groups.

Why a fake VPN makes such an effective lure

Distribution runs largely through social media. Insikt Group found Instagram posts promoting Pis2ray VPN in the weeks following street protests in Iran in late 2025, and again around the country's prolonged internet shutdown, which ended with partial restoration of access on 26 May 2026.

The people most desperate for a virtual private network (VPN) in a censored country are exactly the people most likely to install one from a social media link, because the official stores are often the very thing they cannot reach.

Recorded Future considers it almost certain that most targets are located in Iran or tied to anti-government movements in Europe and North America. TechRadar has covered previous Iran-linked fake VPN campaigns, and this one seems to follow the same pattern with better infrastructure.

How to stay safe

Most readers will never be targeted by a state actor, but the underlying lesson travels.

Install VPN apps only from official stores, and check that the provider has a real, verifiable presence outside the app listing.

Treat any VPN promoted through an Instagram post, a Telegram channel, or a direct message as suspect, however polished it looks.

Star ratings are a weak signal, since fake reviews are cheap.

• Windscribe said Bill C-22 won't change its privacy policies
• The bill would require service providers to retain user metadata
• Canada's Senate is set to discuss Bill C-22 in September

A Reddit user recently put a blunt question to Windscribe: is paying for a Canada-based VPN a privacy problem, given the surveillance bill working its way through Parliament?

The company's official support account answered without hedging. Windscribe will keep operating exactly as it has, the account said, with "no changes to our logging or privacy policies".

Canada is bringing in laws that genuinely complicate things for the company, Windscribe added, but that is internal work to sort out rather than something subscribers should expect to feel.

It's a calmer message than the one Windscribe was broadcasting in May, when it said it would sooner relocate its headquarters than start logging users. That put it alongside Signal and NordVPN, and made it one of the sharpest voices among the best VPN providers fighting the bill.

Bill C-22, formally the Lawful Access Act, cleared the House of Commons on June 18 and now sits with the Senate, which won't begin its study until Parliament returns in September.

Windscribe and Bill C-22: what the VPN provider said

Is paying for Windscribe a problem to privacy given they’re based in Canada and the likely upcoming Bill C-22? Would love to subscribe if not for this. from r/Windscribe

Pressed further in the thread, Windscribe drew a line between where the company is registered and where its infrastructure lives.

The incoming laws could see it served with a court order requiring it to start logging users, the support account acknowledged. Its answer is jurisdictional: a virtual private network (VPN) operating outside Canada doesn't have to comply with Canadian law.

That echoes the route the company has been signalling since May, when CEO Yegor Sak told the Globe and Mail he was actively exploring moving Windscribe out of the country.

Windscribe was also careful to separate provider obligations from user liability. No law currently stops Canadians from using a VPN, it pointed out, and the risk it describes only reaches customers if a provider stays put and starts logging traffic.

For anyone uneasy about the paper trail, Windscribe's suggestion was simple: pay in crypto, so neither the government nor a card issuer sees the purchase.

What's next for Canada Bill C-22

Introduced in March by Public Safety Minister Gary Anandasangaree, Canada Bill C-22 would let the government compel electronic service providers to retain user metadata and build technical capabilities for law enforcement access.

The House passed it at third reading on June 18 after the government moved to limit debate, and the Senate is set to pick it up on September 21, according to Parliament's own LEGISinfo tracker.

Late amendments cut the maximum metadata retention period from twelve months to six and added a clause stating the act can't be read as compelling decryption, unless the provider already holds the keys.

Still, law professor Robert Diab argues that doesn't go far enough, since ministerial orders could still sweep up the metadata of people under no suspicion whatsoever.

The government has consistently rejected the surveillance framing, insisting the bill builds no backdoors and that authorities still need judicial authorisation to obtain data.

ExpressVPN has kept its 30-day money-back guarantee on pause after launching a new promotion to follow its previous World Cup promotion.

The ExpressVPN Summer Tech Competition / Sweepstakes will see the company give away 30 new iPhone 17 Pros, with the caveat that users are not covered by ExpressVPN’s usual 30-day money-back guarantee.

The promotion runs from 11 July 2026 to 11:59 pm BST on 9 August 2026, directly following the ExpressVPN FIFA World Cup 2026 Ticket Giveaway event, which ran from 10 June 2026 to 11 July 2026.

During the promotion, each new sign-up gains 10 entries into the iPhone 17 Pro raffle, with the caveat that all sales are final during this period.

This means that ExpressVPN will not have offered its usual 30-day money-back guarantee for 60 days by the time the Summer Tech Sweepstakes promotion concludes.

Mixed reactions

On the surface, it might seem like ExpressVPN’s decision to remove the money-back guarantee during these promotional periods is logical.

After all, if the option for a refund were still available after entering a raffle for World Cup tickets or a new iPhone, users might attempt to game the system by entering the contest and then cancelling their ExpressVPN plan if they win.

However, ExpressVPN electing to deny users a money-back guarantee for two consecutive months has worried some users, representing a break from industry-standard practice.

Feedback to the decision has been mixed at best, with multiple commenters in the r/Express_VPN speaking out. User QueenBe12 warned others to “be careful” while user rockyyguy called the move “predatory business”, asking "who came up with this idea?"

new scamy tactics: Express VPN does not offer money back guarantee/ no refunds but offers you to enter the raffle to win an iPhone from r/Express_VPN

In a statement given to TechRadar, ExpressVPN said: "ExpressVPN sometimes runs optional, limited-time promotions — such as the current prize draw — which customers can choose to join.

These promotional plans are clearly identified and disclosed at the point of purchase, including that they offer additional benefits, such as prize-draw entry, in place of the 30-day money-back guarantee. This allows customers to make an informed choice about which option best suits them before they subscribe.

Whether a money-back guarantee is offered or not, customers' statutory rights are unaffected. Anyone on a promotional plan can also contact ExpressVPN Support to request a refund, and each request is considered on its merits."

Why are money-back guarantees important for VPNs?

Like most software services, VPNs can be paid for as monthly subscriptions – but almost all VPNs offer huge discounts for signing up to one- or two-year-long plans.

In the case of ExpressVPN, a two-year plan offers an 84 per cent discount versus renewing monthly, and you get four extra months free of charge.

As such, when we talk about VPN pricing here at TechRadar, we’re usually referring to the price of one of these extended plans. It’s typically the most economical choice for most users.

However, our price-based recommendations are usually made in the context of money-back guarantees, which protect users from long payment plans if they sign up to the wrong option or realize that a certain VPN isn’t for them.

These guarantees are offered by many of the best VPNs, and many smaller and mid-tier brands will provide them as well. NordVPN and Surfshark VPN both offer 30 days; CyberGhost bumps this up to 45 days, and Norton VPN gives users a full 60 days.

This is all to say that ExpressVPN removing its money-back guarantee, even for a promotion, is a pretty big deal and a genuine reason to consider avoiding a longer plan until the promotional period concludes.

So, if you’re still keen on picking up ExpressVPN, consider picking up a monthly plan or waiting until 10 August for a longer plan, and be sure to check out our ExpressVPN review for an in-depth breakdown of its features and performance.

In the past year I've spent tens of hours streaming with VPNs, and one thing is consistently problematic for even the best VPNs — live events.

So, if you're traveling and keen to catch BBC's coverage of England vs Argentina later this evening instead, you might think you're stuck. Thankfully, NordVPN proved to be the one streaming VPN I tested that consistently performed well in these scenarios.

Over the past year, I've used NordVPN with Peacock, BBC iPlayer, TNT Sports, ITVX, and 7Plus. And compared to any other VPN, it's proved the most effective.

I experienced the least delayed streams, the least buffering, and, most importantly, the fewest complete connection dropouts when using NordVPN. So, while cheaper alternatives such as Norton VPN and Surfshark exist, if you want the most reliable performance, this is where I'd put my money.

If you don't want a long term commitment, you could always choose to pick a monthly plan. For $15, you can watch the rest of the tournament and gain all the additional security benefits that come with a VPN.

You don't need NordVPN's most advanced features to watch England with a VPN. That's a good thing, as right now its premium plans are considerably more expensive than many other providers.

With long term plans, Surfshark plans start at $2.49/month, a full dollar cheaper per month; the same goes for Norton VPN. If you're really budget-focused, both PIA and Cyberghost are less than $1.60 per month right now, too.

But, should you choose a NordVPN Plus plan or above, you do get some great perks. NordPass, the best password manager we've tested, cloud storage, dark web monitoring, and more are on offer.

It's worth mentioning that buying the more premium plans monthly will set you back at least $20, so I'd recommend signing up for a longer duration if you prefer these extra features.

• Past breach data show over 1.1 million soccer-related passwords
• ExpressVPN found that nearly 1 in 4 football fans use this info in their logins
• Experts urge to delete any sports references from account logins' details

As the FIFA World Cup kicks into high gear, millions of fans are displaying their loyalty online. While you might already be using the best VPN to secure your browsing, ExpressVPN — now an official supporter of the 2026 tournament — is warning that this very public fandom can translate into a major cybersecurity vulnerability.

In a new research report, cybersecurity researcher Jeremiah Fowler partnered with ExpressVPN to examine how soccer obsession influences our password choices. The results suggest that fans are openly handing hackers the keys to their digital lives by using highly predictable phrases.

Fowler's analysis of historical data breaches revealed more than 1.1 million soccer-related passwords. Words like "soccer," alongside massive club names such as "Liverpool," "Chelsea," "Arsenal," and "Barcelona," appeared repeatedly throughout the dataset.

Because fan loyalty is incredibly public, plastered across social media profiles, usernames, and group chats, these passwords are far easier to crack than a random string of characters.

"As a cybersecurity researcher, I've seen criminals target people through the interests they share most openly," Fowler explained. "A club name, player nickname, shirt number, stadium, city, or tournament year may look harmless on its own, but together those details can help someone guess how a fan might build a password or craft a message they're more likely to trust."

An open goal for cybercriminals

To determine if this behavior remains common today, ExpressVPN surveyed 6,000 football fans across six countries. The findings confirm that bad password hygiene is still widespread.

Nearly one in four surveyed fans admitted to having used soccer-related information to secure an account.

Among these fans, the most common choices included their favorite team names, player names or nicknames, and jersey numbers. These easily searchable statistics are exactly what malicious actors look for when compiling custom dictionaries to breach an account.

The fans themselves are surprisingly aware of the risk. In the US, a massive 73.1% of those using soccer-themed passwords acknowledged that someone familiar with their sporting interests could likely guess their login.

This vulnerability is compounded by the fact that many fans are already putting their digital privacy at risk through other careless online behaviors during the tournament.

How to protect your accounts

Using a weak password becomes catastrophic when you consider password reuse. According to Aaron Engel, Chief Information Security Officer at ExpressVPN, the habit of using the same login across multiple services is what turns a minor breach into a full-scale privacy crisis.

"Password reuse is what allows one exposed credential to become a wider account-security problem," warned Engel.

He also noted that fans who share streaming logins put their personal data in further jeopardy: "Sharing passwords increases the number of people and devices that may hold that password; in doing so, users are putting their security into the hands of others. Multi-factor authentication doesn't undo reuse, but it can prevent a stolen password from being enough on its own."

If you want to stay safe while streaming the tournament, you should immediately strip any sports references out of your logins. Instead, use a dedicated password manager to generate complex, unique credentials for every account.

It is also a great time to ensure your overall connection is encrypted, particularly if you are wondering whether to use a VPN to watch the World Cup.

Just keep in mind that new ExpressVPN users still have a chance to win a premium ticket for the World Cup, but you won't get its usual 30-day money-back guarantee.

• ClearVPN now has a dedicated app for Apple TV and Android TV devices
• Users can log in via a quick QR code scan or smartphone link
• The apps include a dedicated Streaming section and Optimal Location tools

Finding the best VPN to secure your online life is increasingly important, but installing it on your living room television hasn't always been a seamless experience. Fortunately, MacPaw is looking to change that with the launch of its "privacy-first" ClearVPN service on Apple TV and Android TV.

With smart TV adoption recently surpassing 900 million units worldwide, our living room watching habits are generating more data than ever. By bringing its software directly to the biggest screens in the home, MacPaw hopes to add a vital extra layer of privacy to users' everyday viewing activities, while simultaneously granting them secure access to global content.

According to the Ukrainian software company, simplifying the user experience remains the top priority.

"We built ClearVPN on one belief: privacy should be effortless," said Tetiana Shokina, Product Manager at MacPaw. "Bringing it to Apple TV and Android TV wasn't a feature request; it was the obvious next step. If simplicity is our promise, it has to work on every screen, including the biggest one."

How to use ClearVPN's smart TV apps

The biggest hurdle with smart TV applications is usually the login process. Nobody enjoys painstakingly typing out long email addresses and complex passwords using a directional TV remote. To solve this, ClearVPN has implemented two simple sign-in methods that entirely bypass the television screen.

Once downloaded, the TV app will display a QR code that users can scan with their smartphone. This instantly opens a pairing page on the phone to authenticate the login, readying the TV app for use.

Alternatively, the app generates a short URL and an activation code that can be typed into any phone, tablet, or computer.

Once inside, ClearVPN's signature intuitive interface keeps technical decisions to an absolute minimum.

An 'Optimal Location' feature automatically connects you to the best available server, meaning there's no need to manually search through endless country lists.

For entertainment fans, a 'Dedicated Streaming' section makes it even easier, connecting users directly to the optimal server for specific streaming platforms so you can start watching privately within seconds.

A quick overview of ClearVPN

If you aren't familiar with ClearVPN, the service was originally launched in 2020 by Kyiv-based MacPaw, a global technology company best known for its signature product, CleanMyMac.

From its inception, the goal was to design an application for everyone, not just the tech-savvy, removing the complex settings that often make cybersecurity software feel intimidating.

In 2024, ClearVPN went through a major redesign as the provider launched improved apps. The service, however, has maintained its core mission: to ensure people's online lives receive the exact same protection as their offline ones.

ClearVPN is powered by modern protocols designed to deliver fast, stable connections, ensuring your streams won't be interrupted by constant buffering. A single subscription protects up to six devices simultaneously, creating a secure digital ecosystem.

New smart TV apps are available now for all ClearVPN users globally. You will need a device running at least Android TV 6+ or tvOS 18+ to install the new applications.

If you want to protect your other hardware, ClearVPN is also available to download on macOS, iOS, iPadOS, Windows, Android, compatible routers, and as a Google Chrome extension.

Traveling to the 2026 World Cup means joining hundreds of thousands of fans in crowded cities across North America.

Airports, stadiums, fan zones, and hotels are all packed with people competing for the same public Wi-Fi networks. These connections are often slow and insecure, making personal data vulnerable to interception.

To stay protected without sacrificing speed, you need more than just a VPN – you need the best VPN with the right settings. Tuning your VPN configuration helps keep your connection secure and fast, no matter where you go during this summer’s tournament.

The 5 best settings to change for top VPN performance

Just turning on your VPN isn’t always enough to cut through the noise of a packed stadium or busy airport terminal. To get good speeds and real security when thousands of people are online at once, here are five specific settings to tweak:

1. Protocol

WireGuard is the superior protocol choice for modern devices, offering faster connection speeds and lower latency compared to OpenVPN or IKEv2.

This efficiency matters when network congestion is high. WireGuard establishes secure tunnels more quickly, reducing wait times. If your provider offers OpenVPN, it's a great alternative for compatibility, but for raw performance in crowded zones, WireGuard is best.

2. Transport protocol

If you've never heard of transport protocols before, think of them as the delivery method your VPN uses to move data. Most commonly, you'll see TCP and UDP as your choices for this.

On congested networks, TCP’s reliability mechanisms can add delay when packets are lost. UDP avoids this overhead by sending data without waiting for confirmation.

In a crowded stadium where every millisecond counts, switching to UDP can reduce latency and improve responsiveness for smooth VPN streaming even when the network is struggling to keep up.

3. Split tunnelling

With split tunneling, you can choose which apps can be routed outside the VPN’s encrypted tunnel. At a stadium, your banking app needs maximum security, but a local map app might benefit from direct access to avoid unnecessary latency.

Excluding non-sensitive apps from encryption can reduce bandwidth strain and prevent compatibility issues with local networks that sometimes block VPN traffic entirely.

4. Location

Connecting to the server closest to your physical location often results in lower ping and faster speeds. However, nearby servers may be overwhelmed by thousands of users connecting simultaneously.

If your current location lags, try switching to a server slightly further away that’s under less user load. Avoid jumping between regions unnecessarily, as crossing international borders increases the distance data travels and introduces lag that ruins live streaming.

5. Obfuscation

In monitored environments like airports, deep packet inspection can detect and block standard VPN traffic.

Obfuscation disguises VPN traffic as regular HTTPS web traffic, allowing you to bypass firewalls and censorship attempts. Although this adds processing that might marginally impact speed, the ability to stay connected when other connections fail more than makes up for this.

As you prepare to cheer on your national team at the 2026 FIFA World Cup, make sure your setup can handle the packed stadiums and busy airports.

By selecting the right VPN protocol, using UDP, and enabling features like split tunneling, you can protect your data and keep your device safe so you can enjoy the World Cup worry-free..