- File sharing apps can host files with malware
- Box and WeTransfer offer virus scanning only with paid plans
- The news comes as the UK looks to boost proactive scanning for illegal content
Have you diligently used the free versions of Dropbox, Box or WeTransfer to exchange files about Christmas gifts or New Year’s party ideas?
If so, you might want to think twice before clicking the “download” button next time, as these free services can host files with viruses or malware, making you more likely to download or share harmful content without realizing it.
The warning comes from Surfshark, one of the best VPNs, which recently conducted an in-depth analysis of six very popular file-sharing apps, to find that most of them do not scan uploaded files for viruses or malware.
Most Free File Sharing Apps Could Be Malware Traps
According to Surfshark’s findings, Box and WeTransfer offer virus scanning only with paid plans, while Dropbox and iCloud do not perform any scanning. iCloud relies on the security of Apple devices for malware scanning, a useless feature if running on Windows.
These emphasize the eternal reminder: reputation does not always go hand in hand with security, particularly for apps that together serve a staggering four billion active users.
Martynas Dainys, senior manager of VPN services at Surfshark, points out that although some of these larger operators have the necessary technological capabilities, they systematically choose to overlook security features simply because they do not generate direct revenue.
The VPN specialist sums up the dilemma with a concise mantra: “If you don’t pay for a service, you often become the product.”
Warn users to place enough trust in these applications: ultimately, any upload or download operation represents a potential access point that can compromise security, especially when using their free versions.
“Ultimately, it is up to users to make informed decisions about the level of risk they are willing to tolerate with their data.”
While it is obvious that using a VPN with built-in antivirus would reduce much of the risk of malware or potential leakage of private information, it is still notable that these apps seek to address these security issues through their paid plans, offering significantly better protection.
For example, the updated Box service offers antivirus and antiransomware scanning, WeTransfer comes with antivirus scanning, and Dropbox provides antiransomware protection.
Perhaps even more interesting is that Google Drive and Microsoft’s OneDrive are currently the only platforms that perform antivirus scanning when uploading or downloading files for free users, although Google limits antivirus scanning to files smaller than 100MB.
Infringing privacy through mass scanning?
Surfshark’s discovery comes just as UK regulator Ofcom shares its intentions to step up file monitoring in 2026 as part of an expansion of the Online Safety Act.
A process already started in 2025, which requires file-sharing companies and other user-to-user services to take greater responsibility for files shared on their platforms in a bid to stop the sharing of child sexual abuse (CSAM) and other illegal content.
However, Surfshark is among experts warning that these scanning requirements could create huge privacy risks by allowing outside entities, including businesses and the government, to access users’ entire digital lives.
While it’s not unreasonable to expect verifications of shared content, the measure becomes a serious privacy issue when it extends to everyone’s private files, particularly for services like Dropbox or cloud backup platforms that are primarily used to store personal files.
Additionally, scanning systems often make mistakes. “Universal mass scanning of all files shared between people would be an unprecedented expansion of mass surveillance powers, resulting in many false positives and innocent people’s content being flagged,” said James Baker of Open Rights Group.
Regardless of regulations, the indisputable truth remains: using your own antivirus software increases the protection of your device. Because one might well suspect that the day we start trusting the health of our files to cloud servers could also be the day we lose control of our privacy.
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds. Be sure to click the Follow button!
