Is That VPN App the Official Build or a Lookalike?

Lookalike software copies names, icons and screenshots, and it connects well enough to look convincing. The tunnel working is not evidence of anything, because the question is who wrote the binary. Treat this as an identity check rather than a security review, and take every reference value from a channel you chose instead of from the app's own page. Five checks follow, and each one can fail while the others pass. Work them in order, because a later check cannot rescue an earlier one.

Get your reference values from a channel you chose

Open the project's official download instructions, or your organisation's managed software channel, before you look at what is installed. Note the expected store publisher, the package or installer identity, and the supported platforms, then keep that note where you will find it at the next update. A search result or a sponsored placement is not that channel, and the paid placement sits above the organic result precisely because people click the first match. Bookmark the page once you have verified it, so the next download starts from a decision rather than from a repeated search.

A mirror or a third-party package repository is also a channel, and it is only as trustworthy as its operator. Write down which one you used, because that detail is the one people forget between updates.

Compare the installed publisher, not the name

Lean on the platform's own signature and application records where they exist, then read the version, the update path and the permissions the app requested. Spotting a valid signature is not the same as spotting the publisher you expected, because a certificate attests only that a binary was signed by whoever holds it. A signature from a company you have never heard of is still a valid signature, which is why the test has to name the party you meant. An installer that bundles extra software, requests a certificate or opens an account prompt you did not expect needs an explanation from the product's own documentation.

# Windows: inspect the installed signature
Get-AuthenticodeSignature "C:\Program Files\WireGuard\wireguard.exe"
# macOS: check the bundle identity
codesign -dv --verbose=2 /Applications/WireGuard.app
# Linux: confirm the package origin
apt-cache policy wireguard

Run the check that matches the platform, and compare its output with the reference note you made in the first step. A mismatch in the publisher field is more informative than any amount of visual similarity, because an icon costs nothing to copy. If the output names an organisation that appears nowhere in the project's documentation, stop there and do not sign in.

What the installed signature actually proves

When a project publishes checksums, signatures or release keys, work through the whole procedure it documents, including the part about obtaining the reference key. A checksum printed on the same page as the download proves only that the file matches that page, which is a weaker claim than it looks. The useful question is whether the signature chains to the identity the project documents, reached through a path the lookalike does not control. This is the step people abbreviate to whether the file has a signature at all.

A key fetched from a keyserver and a fingerprint printed in a README are not equivalent evidence. Decide which one you actually used before you call the file verified.

When the app is real but the profile is not

A client and a server profile come from two different issuers, and confusing them is a separate failure from installing the wrong binary. An OpenVPN build maintained by one project will happily load a configuration written by an unrelated operator, and that is normal behaviour rather than evidence of compromise. The reverse holds as well: a legitimate profile does not make an unofficial client trustworthy. Verify each object against its own source, and never let a working connection collapse two checks into one.

Ask which of the two objects is actually in doubt before acting, because the remedy differs. A bad client means reinstalling, while a bad profile means deleting one file and reissuing it.

Act on uncertainty, then clean up properly

If identity remains uncertain, stop supplying credentials and obtain the software independently through the verified channel you bookmarked. Follow the platform's guidance for unwanted applications instead of deleting a folder and hoping. Then record the publisher, version and verification method you accepted, so the next update can be compared with a fact rather than with memory.

After a legitimate replacement, walk the old profiles and permission grants through both the client and the operating system. Uninstalling the downloaded file leaves the installed application in place, and an old profile can outlive the client that created it while still pointing at an endpoint nobody maintains. WireGuard's official installation page is a fair example of the kind of reference worth keeping: it is the developer's own list rather than a mirror.