Loading Now
How To

Are They Selling Your Data?

How Urban Cyber VPN Security Products Sold Private Data

For quite some time, the team at URTech.ca has been highlighting that using a VPN as a home user does little to enhance your security. VPNs merely shift your digital traces from one location to another, and they can sometimes even lead to security issues. Today, we’re sharing a significant warning that affects 8 million users!

Who Discovered the Issue?

Security researchers at Koi Security recently uncovered that data collection practices were embedded directly in the extension’s code and were distributed through official updates.

Let’s Profit from Data!

This data harvesting feature wasn’t due to a cyberattack from outsiders; rather, it was a legitimate function added by the developer, Urban Cyber Security Inc., in version 5.5.0, which was launched on 9 July 2025.

  • Motivation Behind It: Urban VPN is either owned by or affiliated with BiScience (B.I. Science Ltd.), a notable data broker.
  • Business Model: The data collected from AI interactions, often containing sensitive information such as proprietary code, medical queries, and financial details, is being aggregated and sold for “marketing analytics.” SOURCE
How Urban Cyber VPN Security Products Sold Private Data

Misleading “Protection” Features

To obscure the data harvesting from users, the company promoted a feature called “AI Protection.” The extension would occasionally issue warnings about the risks of sharing sensitive information with AI platforms like OpenAI or Google.

  • What’s Really Happening: While the extension alerted users about sharing data with AI, it simultaneously gathered that exact data and transmitted it to Urban VPN’s servers. Even if a user disabled the “AI Protection” option, the data collection script continued to operate in the background. SOURCE

Advanced “Executor” Scripts

This was not a mere unintentional log. Researchers uncovered targeted “executor” scripts customised for different AI platforms (such as chatgpt.js, claude.js, gemini.js). These scripts performed the following functions:

  • Intercepting Network Traffic: They manipulated the browser’s standard functions to access the “raw” data before it was displayed.
  • Data Capture: They didn’t just collect text; they also recorded timestamps, conversation IDs, session metadata, and the specific AI models being used. SOURCE
  • Bypassing the VPN Toggle: Data harvesting continued without interruption as long as the extension was installed, regardless of whether the VPN was active or inactive.

Which Products Are Affected?

This malicious code was discovered in various other extensions from the same publisher, bringing the total number of affected users to more than 8 million. These include:

Urban VPN Selling Users Private Data
  • Urban VPN Proxy (available for Chrome & Edge)
  • 1ClickVPN Proxy
  • Urban Browser Guard
  • Urban Ad Blocker

The developer, Urban Cyber Security, also provides the following products which have not been confirmed as malicious, but we advise you to look for alternatives:

Desktop & Mobile Applications:

  • Urban VPN Desktop: Dedicated applications available for Windows and macOS.
  • Urban VPN Mobile: Applications offered for Android (Google Play) and iOS (App Store).
  • Urban Shield / Urban Shield Desktop: A security tool aimed at enhancing productivity for both desktop and mobile devices.

Browser Extensions:

  • Urban Safe Browsing: An extension designed to protect against malicious software and spam.

Is This Legal?

Well, yes… remember those lengthy 68 pages of terms and conditions that you probably didn’t pass to your expensive lawyer or even glance at before clicking AGREE? That’s their loophole.

Urban VPN updated its Privacy Policy around the same timeframe it released version 5.5.0 in July 2025, adding wording that specifies their collection of “AI Inputs and Outputs” as part of browsing data.

The policy claims this data is collected to “enhance the Safe Browsing feature” (to caution users about sharing sensitive information), but then immediately follows by stating they “disclose the AI prompts for marketing analytics purposes.” SOURCE

What YOU Should Do?

If you have used these extensions at any point since 9 July 2025, it is wise to assume that every interaction you had with ChatGPT, Claude, Gemini, Copilot, Perplexity, DeepSeek, Grok, or Meta AI has been extracted and sold.

We strongly recommend that you uninstall these extensions immediately. In fact, to be on the safe side, we suggest uninstalling all products offered by Urban.

There is no option to “opt-out” because the data collection is hard-coded into the software itself. Going forward, be exceedingly cautious with “Free VPN” extensions, as they typically monetise users’ data more than anything else. SOURCE

Conclusion

Before opting for a VPN, consider what it truly offers and any potential drawbacks. VPNs simply virtually relocate you from your home to a different city—nothing more. They can be beneficial for accessing content restricted to specific regions (like BBC.com and FIFA streaming) but are not necessarily effective for enhancing security.

If you’ve decided that the benefits of widening your “attack surface” by employing a VPN outweigh the risks, ensure you choose a reputable option. Steer clear of free services; your data is too precious to expose to potential exploitation. Just like “free” social media platforms, YOU might become the product they end up selling!

Related Posts