Six VPN apps, including MaskVPN, DewVPN, PaladinVPN, ProxyGate, ShieldVPN, and ShineVPN, were found infecting users with malware, contributing to the 911 S5 botnet, which affected over 19 million IP addresses globally. The botnet facilitated criminal activities like financial fraud and identity theft. The U.S. Department of Justice announced the botnet's takedown and the arrest of its administrator, YunHe Wang. Despite the disruption, the malware remains a threat on infected devices. Users should uninstall these VPN apps, end malicious processes, and run malware scans with tools like Malwarebytes or Bitdefender