A poor-quality or untrustworthy VPN is dangerous because it can place itself directly in the path of almost all traffic leaving a device. That gives the VPN operator a privileged position to observe, manipulate, log, or redirect data before it reaches its true destination.

The key point is this:

• A VPN does not magically make traffic safe.
• A VPN simply changes who is trusted with carrying the traffic.
• If that new trusted party is dishonest, careless, compromised, or badly configured, the risk can be severe.

Why the VPN is in such a powerful position

When a device connects to a VPN, it usually sends most or all network traffic through an encrypted tunnel to the VPN provider’s server. From there, the VPN server forwards the traffic onwards to websites, cloud services, email platforms, banking systems, and other destinations.

In practice, this means the VPN provider can often see:

• which services are being accessed
• when connections are made
• source device details
• destination domains or IP addresses
• the volume and timing of traffic
• unencrypted traffic contents
• some encrypted session metadata

If the VPN is configured as the default route, the VPN provider becomes the main transit point between the user and the internet. That is exactly why a bad VPN is so risky.

What “intercepting at source” means

A dodgy VPN can interfere with traffic very early in the connection path, effectively at the point where the device first hands off data for onward delivery.

This is important because:

• the VPN software often has high privileges on the device
• it may install virtual network adapters
• it may alter routing tables
• it may set DNS servers
• it may install trusted certificates
• it may force all traffic through its own infrastructure

Because of this control, the VPN can do more than simply “carry” traffic. It may also:

• inspect it
• reroute it
• downgrade it
• block it
• replace responses
• inject content
• impersonate trusted endpoints in some scenarios

How a malicious or compromised VPN can perform a man-in-the-middle attack

A man-in-the-middle attack, often abbreviated as MITM, happens when a third party secretly places itself between the user and the service they think they are talking to.

With a VPN, this can happen in several ways.

1. Intercepting unencrypted traffic directly

If a website or service uses plain HTTP, unencrypted email protocols, insecure VoIP, or other clear-text communication, the VPN provider can read the contents outright.

That may include:

• usernames
• passwords
• card numbers
• form contents
• search terms
• messages
• session cookies

Anything sent without proper end-to-end encryption can be exposed immediately.

2. Manipulating DNS

Many users focus only on website encryption, but DNS is also critical. DNS decides where a domain name points.

If the VPN controls DNS resolution, it can:

• log every domain lookup
• redirect domains to malicious servers
• block legitimate domains
• send users to phishing copies of real services

For example, a user might type a genuine banking or email address, but manipulated DNS could return the address of a fake system designed to steal credentials.

How secured traffic can still be at risk

A common misunderstanding is that HTTPS or other encryption means the VPN can never interfere. Properly implemented end-to-end encryption does greatly reduce risk, but it does not eliminate it completely.

Normal HTTPS protection

Under normal circumstances, HTTPS protects traffic between the browser and the real website by:

• encrypting the data in transit
• verifying the site’s certificate
• preventing third parties from reading or altering the content without detection

If HTTPS is working correctly and the user is actually connected to the legitimate server, the VPN provider should not be able to see passwords, passkeys, or card numbers in plain text.

However, a dodgy VPN can still create opportunities to defeat or weaken this protection.

1. Installing a rogue trusted certificate

Some VPN software, security products, “web protection” tools, or badly behaved corporate inspection tools install their own root certificate on the device.

If a VPN operator can get a device to trust its certificate authority, it can intercept HTTPS by doing the following:

1. The user tries to connect to a secure website.
2. The VPN terminates the secure connection itself.
3. The VPN creates a separate secure connection onwards to the real site.
4. The device sees a certificate it trusts, because the VPN’s root certificate was installed locally.
5. The user sees a padlock and assumes the connection is secure.

In that situation, the VPN can decrypt and inspect everything in the middle.

That can expose:

• login credentials
• one-time codes entered into websites
• payment card details
• personal data
• downloaded files
• uploaded documents

This is one of the most serious risks because the protection appears normal to the user.

2. Redirecting users to fake websites

Even without breaking HTTPS directly, a rogue VPN can attempt to redirect traffic to fake services.

Examples include:

• phishing pages made to look like Microsoft 365, Google, banks, or payment gateways
• fake password reset pages
• cloned webmail portals
• fraudulent “session expired” prompts

If the user enters details into the fake site, the encryption is irrelevant because the user has handed the secret directly to the attacker.

3. SSL stripping or protocol downgrades

On badly designed sites or applications, an attacker in the path may try to downgrade the connection from encrypted to unencrypted, or interfere with redirects that should move the user from HTTP to HTTPS.

This is less effective on modern, well-configured services using HSTS and strong browser protections, but it still matters for:

• legacy applications
• embedded devices
• poorly configured business systems
• old mobile apps
• non-browser software

4. Capturing tokens and session data from insecure apps

Not all apps are as well protected as modern browsers. Some applications:

• validate certificates poorly
• ignore certificate warnings
• use outdated encryption libraries
• transmit tokens insecurely
• fail to pin certificates properly

A malicious VPN can exploit these weaknesses to capture:

• session cookies
• bearer tokens
• API keys
• authentication headers

Those may be just as valuable as a password.

5. It's not always the VPN provider - VPN companies 'rent' servers from other companies, and those companies can interfere with those servers outside of the VPN providers control. This famously occurred in the TOR network where the FBI were able to compromise enough servers to mount a MIIM attack. 

How passwords, passkeys and card details can be exposed

Passwords

Passwords are at risk when:

• they are sent over unencrypted connections
• the user is redirected to a fake login page
• HTTPS is intercepted using a rogue certificate
• a malicious app sends them insecurely
• session tokens are stolen after login

Passkeys

Passkeys are generally safer than passwords because the private key should stay on the user’s device and is not transmitted to the website.

However, a bad VPN can still create risks around passkeys by:

• redirecting the user to a fake site and tricking them into approving access
• stealing session cookies after successful authentication
• intercepting fallback login methods such as passwords, SMS codes, or recovery prompts
• facilitating account takeover where passkeys are not the only recovery method

So while passkeys are more resistant to interception, the surrounding account process may still be attacked.

Card numbers

Card details can be exposed if:

• the payment page is fake
• the VPN is decrypting HTTPS through an installed trusted certificate
• the device is redirected to a fraudulent checkout
• card details are typed into an insecure app or form

Even where card processors use strong security, a stolen card number, expiry date, name, and billing details may still be enough for fraudulent use.

Additional risks beyond direct interception

A dodgy VPN does not need to read every packet to be dangerous. Other risks include:

• extensive logging of browsing habits
• selling behavioural data
• injecting adverts or tracking scripts
• replacing downloads with tampered files
• exposing users to malware
• leaking DNS requests outside the tunnel
• poor server security leading to third-party compromise
• weak encryption or obsolete protocols
• shared exit nodes used for abuse or criminal activity

Some “free” or unknown VPN services have historically funded themselves by monetising user data, using weak controls, or repurposing user devices and bandwidth in unsafe ways.

Summary

A dodgy VPN is “very very bad” because it can sit directly in the path of traffic at the point it leaves the device, giving it a unique opportunity to observe, alter, redirect, or impersonate connections.

Any good corporate security policy will ban these outright and impose strict penalities if discovered due to the significant risk it poses. Speak to your IT department, or to GEN and take the appropriate advice on what to use and when.