Teens using VPN to cheat in Gorilla Tag are unknowingly selling their internet connections

Facepalm: A seemingly harmless trend among teenagers playing the hit VR game Gorilla Tag has raised serious security concerns. Kids have been turning to a free VPN app called Big Mama VPN to gain an edge, but they may be unwittingly renting out their home internet connections to shadowy third parties in the process.

Gorilla Tag is a zany multiplayer experience where players take control of gorilla characters and attempt to evade being "tagged" by other players. It's simple fun, but some young gamers discovered a sketchy workaround to make tagging others easier. Many players are now sideloading a VPN called Big Mama to reroute their internet connection, which introduces a lag that makes it easier to sneak up on opponents.

While this cheat sounds relatively harmless, the implications are far more sinister. As it turns out, Big Mama is more than just a VPN – it's a gateway into a shady residential proxy service peddled on cybercrime forums.

Security researchers at Trend Micro discovered that Big Mama has been selling access to its users' internet connections on a huge proxy marketplace. Bad actors can temporarily piggyback on a Big Mama user's home IP address to hide their online activities for as little as 40 cents.

Cybersecurity firm Kela notes that the Big Mama proxy service has also been actively promoted in hacker circles, with over 1,000 mentions across 40 different underground forums. Security researchers have linked proxy IP addresses to various nefarious deeds, including DDoS attacks, phishing scams, and malicious botnets.

While Big Mama claims it only provides service for "legal purposes," the app's terms quietly disclose that it "may transport other customer's traffic" through users' connections. Meanwhile, the creators of Gorilla Tag have denounced the use of VPNs and cheating software, stating that "anything that disturbs" the game's playful spirit is unacceptable.

We've seen this type of behavior from free VPNs before. Earlier this year, the US sanctioned three Chinese nationals for operating 911 S5 – a massive botnet of 19 million IP addresses that exploited free VPN services to hijack Windows PCs.

Since these services don't charge their users, operators need something to pay for the server costs. Unfortunately, unscrupulous providers often use shadier revenue-generating methods like selling user data, piggybacking third parties across IPs, or installing malware.