Am I Being Pwned? logoAm I Being Pwned?by Bay Area Labs
Contact usScan my org
HomeSurfshark VPN: stable & fast
Findings · 3
MEDIUM FINDINGS · 3
  1. 01The Dausos packet-tunnel binary contains a 'PersistentAnalyticsManager' / 'VpnTunnelPersistentAnalyticsEvent' subsystem whose Swift method signatures pass appsFlyerID, IDFA and GoogleAnalyticsParameters to a SUAPIManager send method — i.e. tunnel/connection events are correlated to advertising identifiers and shipped to Surfshark's API.
  2. 02Packet-tunnel network extensions tunnel all device traffic through Surfshark VPN servers (WireGuard, OpenVPN, Dausos custom protocol, plus a DNS proxy variant).
  3. 03Sentry iOS/macOS crash and performance reporting SDK is embedded directly in every packet-tunnel network-extension binary; crashes and performance events are shipped to two self-hosted Sentry projects on go-apple-s.surfshark.com (DSNs /50 and /51).
OTHER EXTENSIONS

Is Surfshark VPN: stable & fast safe?

Medium risk

No summary available.

Surfsharkv4.27.2Chrome Web Store
45Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Updated 30 May 2026com.surfshark.vpnclient.macos.PacketTunnel-Dausos

Am I Being Pwned?

Protecting organizations from malicious browser extensions.

© 2026 Bay Area Labs Inc. All rights reserved.

BlogFree Org ScanHow it worksSecurityFor VendorsFAQThreat Intel FeedAPI DocsPrivacy PolicyTerms of ServiceContact