Summary: Swing VPN, an app with over 5 million installs on Android, has been found to use its user base to launch DDOS attacks on specific websites. The app sends requests to resource-intensive endpoints, causing server stress and potentially denying access to legitimate users. The iOS version, however, does not exhibit this behavior and is deemed safe. Swing VPN also disregards user privacy, sending data to ad networks without user consent.