- File sharing apps can host files with malware
- Box and WeTransfer only offer virus scanning with paid plans
- The news comes as the UK looks to increase proactive scanning of illegal content
Have you extensively used free versions of Dropbox, Box or WeTransfer to exchange files about Christmas gifts or New Year holiday ideas?
If so, you might want to think twice before clicking the ‘download’ button next time, as these free services may host files with viruses or malware, making you more likely to download or share harmful content without realizing it.
The warning comes from Surfshark, one of the best VPNs, which recently conducted an in-depth analysis of six super popular file sharing apps to find that most of them do not scan uploaded files for viruses or malware.
Most free file sharing apps can be malware traps
According to Surfshark’s results, Box and WeTransfer only offer virus scanning with paid plans, while Dropbox and iCloud do no scanning at all. iCloud relies on Apple Device Security for malware scanning – a pointless feature if running on Windows.
These underscore the eternal reminder: reputation doesn’t always go hand-in-hand with security—especially for apps that collectively serve a staggering four billion active users.
Martynas Dainys, senior VPN service manager at Surfshark, notes that while some of these largest operators have the necessary technological capabilities, they systematically choose to overlook security features simply because they don’t generate direct revenue.
The VPN specialist sums up the dilemma in a succinct mantra: “If you don’t pay for a service, you often become the product yourself.”
She cautions users to have an appropriate level of trust in these apps: ultimately, any upload or download operation represents a potential access point that could compromise security, especially when using their free versions.
“Ultimately, it is left to users to make informed decisions about the level of risk they are willing to tolerate with their data.”
While it is obvious that using a VPN with integrated antivirus would greatly reduce the risk of malware or possible leakage of private information, it is still noteworthy that these apps seek to tackle these security issues through their paid plans, providing significantly better protection.
For example, Box’s upgraded service offers both antivirus and anti-ransomware scanning, WeTransfer comes with antivirus scanning, and Dropbox provides anti-ransomware protection.
Perhaps even more interestingly, Google Drive and Microsoft’s OneDrive are currently the only platforms that perform antivirus scanning when uploading or downloading files for free users, although Google limits antivirus scanning to files smaller than 100MB.
Does mass scanning violate privacy?
Surfshark’s discovery comes as UK regulator Ofcom shares its intentions to double file monitoring by 2026 as part of an expansion of the Online Safety Act.
A process already started in 2025, which requires file-sharing companies and other user-to-user services to take greater responsibility for files shared on their platforms in an effort to stop the sharing of child sexual abuse (CSAM) and other illegal content.
Still, Surfshark is among the experts who warn that these scanning requirements could create huge privacy risks by giving outside entities, including businesses and the government, access to users’ entire digital lives.
While it’s not unreasonable to expect control over shared content, the move becomes a serious privacy concern when it extends to everyone’s private files—especially for services like Dropbox or cloud backup platforms that are largely used to store personal files.
In addition, scanning systems often make mistakes. “Universal mass scanning of all files shared between people would be an unprecedented expansion of mass surveillance powers, resulting in many false positives and innocent people having their content flagged,” said James Baker of the Open Rights Group.
Regardless of the rules, the undeniable truth still stands: using your own antivirus software increases the protection of your device. Because one might well suspect that the day we start entrusting the health of our files to cloud servers may also be the day we lose control over our privacy.
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews and opinions in your feeds. Be sure to click the Follow button!
