A new investigation has revealed that Apple and Google’s app stores have been hosting several popular virtual private network (VPN) apps linked to Qihoo 360, a Chinese cybersecurity company blacklisted by the US government due to alleged military ties.
According to research by the Tech Transparency Project (TTP) and additional findings by the Financial Times, at least five free VPN apps available in the US app stores—including Turbo VPN, VPN Proxy Master, Thunder VPN, Snap VPN, and Signal Secure VPN—are connected to Qihoo 360. The company, officially known as 360 Security Technology, was sanctioned by the US in 2020 and later designated by the Department of Defense as a Chinese military-affiliated entity.
The report warns that “millions of Americans are inadvertently sending their internet traffic to Chinese companies,” raising fresh concerns about data security and the potential risks of user information being accessed under China’s national security laws.
VPNs are widely used to bypass geographic restrictions and encrypt internet traffic, but they also grant operators oversight of user data. Under Chinese law, companies must comply with state intelligence investigations and hand over data upon request.
The five Qihoo-linked VPNs remained available on Apple and Google’s US app stores until last week. Following inquiries from the Financial Times, Apple removed Thunder VPN and Snap VPN from its store. Estimates from Sensor Tower indicate that three of these VPNs had collectively received over one million downloads in 2025.
Ownership records show the VPN apps are operated by Singapore-based Innovative Connecting Pte, which is in turn owned by Lemon Seed Technology, a Cayman Islands-registered company. In January 2020, Qihoo 360 reportedly acquired Lemon Seed for $69.9 million, just months before the US added the firm to its trade blacklist. By September 2020, Qihoo claimed to have sold the business, though records suggest that developers linked to Qihoo continued working on the VPNs.
Despite claiming to have divested from its overseas VPN business, Qihoo maintained indirect control. A subsidiary established in December 2019 to employ the app developers—later renamed Guangzhou Lianchuang Technology—remained under Qihoo until it was sold in 2023 to a newly created Beijing-based company for just 1 yuan (RMB).
The new company’s majority owner, Chen Ningyi, has a history of working within Qihoo’s mobile security division and serves as the sole director of Lemon Seed. When an FT reporter visited Guangzhou Lianchuang’s office, two employees confirmed they were working on the foreign VPNs and acknowledged ties to Qihoo. “You could say that we’re part of them and you could say we’re not,” said one of the developers, describing the situation as “complicated.”
Recruitment listings for Guangzhou Lianchuang indicate that its VPN apps operate in more than 220 countries and have 10 million daily users. One recent job posting sought a candidate “well-versed in American culture” to assist in monitoring and analyzing platform data.
Both Apple and Google have strict policies prohibiting VPN apps from collecting or sharing user data without consent. However, enforcing these policies remains a challenge. Johns Hopkins University cryptography expert Matthew Green warned that VPNs operate at a deep network level, making it difficult to verify whether they adhere to privacy policies. “It’s not a very binding promise, and not something that is very easy to enforce,” Green stated.
Apple previously removed VPN apps from its China App Store in 2017, complying with Chinese censorship laws. Google, which withdrew from China in 2010, does not offer the Play Store in the country.
In response to the findings, Apple stated it complies with all relevant regulations and takes action against apps that violate its VPN policies. However, it noted that its rules do not restrict app ownership based on nationality. Google said it remains committed to compliance with sanctions and trade laws, taking action when violations are detected.
To improve transparency, Google recently introduced a “verified” badge for VPN apps that meet additional security criteria. Notably, Turbo VPN—one of the Qihoo-linked apps—received this verified status.
Qihoo 360, Innovative Connecting Pte, and Chen Ningyi did not respond to requests for comment. Guangzhou Lianchuang declined to provide a statement.
