Field Notes

entity

Malwarebytes

StatusStableReviewdue UpdatedStands on4 sourcesSupportsnotes

Malwarebytes is a US cybersecurity company headquartered in Santa Clara, California, founded on 21 January 2008 by Marcin Kleczynski and Bruce Harrison. Kleczynski began writing malware-removal tools as a teenager — the RogueRemover utility grew out of cleaning infections encountered in computer-repair work — and remains CEO.1 The product line spans consumer anti-malware and enterprise endpoint protection, with acquisitions filling out adjacent capabilities: AdwCleaner, the adware and potentially-unwanted-program (PUP) removal tool, in October 2016,2 and the Swedish VPN provider AzireVPN in November 2024.3

The VPN story

The vault cares about Malwarebytes chiefly through its VPN history, which traces the assurance question across three providers. Malwarebytes Privacy VPN launched in 2020 and ran on Mullvad’s server network from an October 2019 partnership — a white-label arrangement in which the privacy guarantees were effectively Mullvad’s to keep. The November 2024 AzireVPN acquisition moved the service onto AzireVPN’s owned-and-diskless infrastructure, so Malwarebytes Privacy VPN and AzireVPN now share the same server software and hardware. That shared stack is why the X41 D-Sec audit of December 2025–January 2026 covered both services at once, verifying the no-logs deployment while also finding two critical supply-chain and boot-chain vulnerabilities.4

The ownership case study

AzireVPN is the vault’s worked example of what ownership change does to a privacy provider’s guarantees. The technical practices — self-owned diskless servers, the Blind Operator kernel module — were promised to continue, and the X41 audit later verified them as deployed. What changed is the accountability chain: the ultimate parent is now a US-incorporated company, while Netbouncer AB, the Swedish operating entity, remains subject to Swedish and EU law. The acquisition also illustrates the consolidation pattern in which larger US security vendors absorb small privacy-focused VPN providers, leaving founder-owned Mullvad and IVPN as the independent comparison points.

  1. Malwarebytes company page, on the founding story, Kleczynski’s continuing role, and the Santa Clara headquarters. ↩

  2. Malwarebytes press release, 19 October 2016, announcing the AdwCleaner acquisition. ↩

  3. Malwarebytes press release, 7 November 2024, announcing the AzireVPN acquisition; see also Malwarebytes acquires AzireVPN and AzireVPN joins forces with Malwarebytes. ↩

  4. The X41 audit report, summarized in Penetration Test on AzireVPN. ↩

Built on 4 sources (4 external).

Working out connections…