How ExpressVPN Sold Out to Shady Malware Company

ExpressVPN was acquired for $936 million by Kape Technologies — a company that literally distributed malware before rebranding themselves as privacy protectors.

Let me be crystal clear: I don’t hate VPNs. They’re useful tools for specific purposes. What I hate is when a company that allegedly distributed malware buys the VPN you trust with your privacy, and nobody talks about it because they’re making $95 per referral.

Kape Technologies used to be called Crossrider. According to security researchers at Malwarebytes and others, their business model allegedly involved distributing adware and browser extensions that injected ads. Now they own ExpressVPN, CyberGhost, Private Internet Access, and the “review” sites that recommend them.

Still trust ExpressVPN? Let me show you exactly who has your data now.

⚡ 30-Second Truth Bomb

• ExpressVPN sold to Kape Technologies (formerly Crossrider) for $936 million
• Kape allegedly distributed malware and adware before rebranding (per security researchers)
• Founded by convicted insider trader + former Israeli intelligence officer
• They own your “alternatives”: CyberGhost, PIA, ZenMate
• Mullvad alternative: No affiliates, accepts cash in envelopes

The Problem: A Malware Company in a Privacy Cloak

This isn’t some conspiracy theory. This is all public information they hope you’re too lazy to look up.

Evidence 1: The Founders - A Spy and a Convict

Before Kape was Kape, it was a company called Crossrider. Let’s talk about who built it.

• The Money: Teddy Sagi, a billionaire who was convicted of insider trading in the 1990s according to public court records.
• The Brains: Koby Menachemi, reportedly a former developer for Unit 8200, Israel’s signals intelligence unit.

In my opinion, it’s concerning that a person with a financial fraud conviction and someone with a state surveillance background allegedly teamed up to create a company that, according to security researchers, distributed adware. And now they own the VPN you use to stay “private.”

Evidence 2: The Original Sin - Crossrider’s Adware Empire

According to security researchers and public reports, Crossrider’s business model was allegedly the exact opposite of privacy. They reportedly built a platform for developers to inject ads into browsers. A 2015 study by Google and UC Berkeley identified them as playing a central role in the “ad injection economy.”

Security companies like Malwarebytes flagged their products as adware. Even the founder of CyberGhost, before selling his company to them, admitted: “while CyberGhost focused on privacy… Crossrider started out as a company that distributed browser extensions and developed ad tech products. Quite the opposite of what we did.”

Evidence 3: A New Name to Hide a Filthy Past

So, what does a company with a toxic reputation do? Rebrand.

In 2018, Crossrider officially changed its name to Kape Technologies. According to their own CEO, the change was to escape the “strong association to the past activities of the company.”

Notice he didn’t say they changed their activities. He said they wanted to escape the association. In my opinion, that’s like someone with a questionable past changing their name and expecting you to forget their history. I believe it’s just rebranding without real reform.

Evidence 4: Buying the Watchdogs

This isn’t Kape’s first rodeo. They’ve been on a shopping spree, buying up VPNs to create a monopoly on the very industry that’s supposed to protect you from companies like them.

Here’s who they own now:

• ExpressVPN
• CyberGhost
• Private Internet Access (PIA)
• ZenMate

They’re not just buying VPN companies; they’re buying up the market to control the narrative. To make matters worse, they also own a collection of VPN “review” websites that—surprise, surprise—rank their own products at the top. It’s a closed-loop win-win for Kape.

• VPN Mentor - a high-profile VPN review site packed with affiliate links from Kape VPNs and other owned brands like Intego antivirus.
• Safety Detectives - another well-known VPN review website, peppered with affiliate links from Kape-owned brands.

🔍 Don’t Trust Me? Verify This Yourself

1. Google “Crossrider malware” - see the security warnings
2. Search “Kape Technologies Teddy Sagi insider trading”
3. Look up “ExpressVPN acquisition September 2021”
4. Check who owns VPN Mentor and Safety Detectives
5. Try finding ONE Mullvad review with an affiliate link (spoiler: you won’t)

How They Get Away With It: The Affiliate Marketing Playbook

So why are you still seeing your favorite YouTubers and bloggers pushing ExpressVPN?

Simple: money.

ExpressVPN pays massive affiliate commissions. We’re talking $95-100, sometimes more, for every person who signs up through their link. In my opinion, they’re counting on these “influencers” to be too financially motivated to look into the new ownership.

I could be making significant money telling you ExpressVPN is great. But I believe in being honest with my readers. I’d rather make nothing than mislead you.

The Alternative: A VPN That Hasn’t Sold Its Soul

Look, if you want to trust your data to a former malware distributor, be my guest. Keep using ExpressVPN. It’s your funeral.

But I moved everything I own to Mullvad VPN. Here’s why:

• No User Accounts: You don’t create an account with an email and password. They generate a random 16-digit account number for you. No personal information is ever tied to your account.
• Anonymous Payments: You can pay with crypto, or you can literally put cash in an envelope and mail it to them. That’s how serious they are about privacy.
• Independently Audited: They’ve undergone numerous independent security audits and have a proven track record of protecting user privacy. They have nothing to hide.

Here’s my affiliate link: [I don’t have one, because Mullvad doesn’t have an affiliate program. That’s how you know they’re legit.]

Just go to their site and sign up. It’s about $5 a month. No bullshit long-term contracts, no fake discounts. Just privacy.

🧪 Test This Yourself

Want proof ExpressVPN isn’t what they claim? Run these tests:

• Check their real server locations: ipleak.net
• Test for DNS leaks: dnsleaktest.com
• Verify Kape ownership: Search “ExpressVPN Kape Technologies acquisition”
• Find their malware history: “Crossrider browser extensions malware”
• See their review site empire: “VPN Mentor Kape ownership”

-The Angry Dev Still angry, still honest