2025 has been a year of campaigns, audits and improvements to our suite of obfuscation methods.Here we highlight what we think you should be aware of from this year as it comes to an end.Quantum-resistant tunnels on every desktop platformThe first app release of the year, 2025.2 enabled Post-Quantum WireGuard by default on Windows, making it the final platform to enable quantum resistance by default. All apps across all platforms now have WireGuard with quantum-resistance enabled by default.Partnership with Obscura VPNFebruary brought the announcement that we were commencing a partnership with the “Two-Party VPN” provider, Obscura VPN. This partnership means that customers of Obscura (a service separate from Mullvad VPN, and not available to Mullvad VPN customers directly) are able to use Mullvad’s WireGuard VPN servers as an “exit hop”. Further information is available on Obscura VPN's website.Fighting for privacy with our first outdoor campaign of 2025In late February we covered billboards, public transport and outdoor spaces of various cities across the USA with our stances on privacy, the debate on freedom of speech, and mass surveillance. This was the first of many campaigns we did during 2025.Android security audit, reproducible builds and multihopOur Android app was successfully audited during March, passing Mobile Application Security Assessment (MASA) in the process, as confirmed by NCC Group. We were proud to say that version 2024.9 of our Android app passed all controls without the need for any fixes or modifications.March also brought the introduction of multihop to Android, version 2025.1 introduced the ability to route traffic through two servers.Finally, the 2025.2 release of the Android app introduced reproducible builds, which means that anyone can verify that the app downloaded and installed is built from the open-source code which we publish.Lightning paymentsAt the start of August we enabled instant transactions, lower fees and enhanced privacy with the introduction of Bitcoin Lightning. We run our own lightning node, and continue to offer a 10% discount when paying with it, along with all other cryptocurrencies supported by Mullvad.Website security audit by Assured ABThe audit showed that we had no critical, high, or medium-severity issues on our website. All low-severity issues were promptly fixed during the audit period, and Assured concluded that “Good security practice is followed in all parts of the reviewed web applications”.QUIC and LWO obfuscation methodsTwo new methods to make it harder for firewalls to detect and block traffic were introduced in September and November respectively. Both obfuscations are available on a subset of our WireGuard servers.Version 2025.8 on iOS and Android brought QUIC. Android release 2025.9 and Desktop release 2025.13 brought LWO. iOS is planned for early 2026.The introduction of these obfuscation methods brings the total to four added methods in 2025, which we mentioned as being part of our ongoing effort to fight censorship and improve the user experience in restrictive networks.Leta shutdownWe decided to shut our search engine Leta down at the start of November. Leta was introduced as an experiment, a way to see whether we could improve the privacy of our users further. We concluded after two years that similar privacy can be achieved through the combination of a VPN and a privacy-focused browser.Removal of OpenVPN from our desktop appsOpenVPN will be completely removed on 15th January 2026, and in preparation, version 2025.14 of the desktop app removed all mention of the protocol. Please ensure you are prepared for the removal of OpenVPN prior to the cut-off date.And then?Chat Control is back on the menu, and to highlight the corruption behind the proposal we introduced our video campaign, “And then?”. This campaign has been split into multiple videos of varying lengths, shared across many different channels, online and on TV in Australia, Sweden, Germany, and the USA.Shortly after the release of the campaign, we learned that the Council of Ministers in the EU had, after three years, reached a common position on Chat Control. The requirement for mandatory scanning (including end-to-end encrypted messaging services) was removed, which is a major victory.And then?We will continue to fight against Chat Control, our views on privacy, striving to make mass surveillance as impractical as possible throughout 2026 and beyond.Mullvad VPN