NordVPN
NordVPN is a paid service that encrypts your internet connection and routes it through a server in a location you choose. It’s made by Nord Security, based in Lithuania.
Criminals have used its name in fake downloads or scams, so get it only from nordvpn.com.
What it is
People use NordVPN to protect internet traffic on public Wi-Fi, hide their usual IP address and connect through another country. Its Meshnet feature can also link devices for remote access and file sharing.
The app handles internet traffic across the Mac. The website version also offers protection that checks websites and downloaded files for threats. Its file protection asks for Full Disk Access. The App Store version has more limited protection features.
The genuine app is a legitimate VPN service with published independent security audits. NordVPN says it does not keep browsing activity logs. Researchers have found security flaws, including the fixed issues listed below.
Who makes it
Nord Security is a cybersecurity company based in Vilnius, Lithuania, whose first product was NordVPN in 2012. Its legal name is NordSec B.V.. Its website is nordsecurity.com.
Is it the real one?
Every Mac app carries a signature from the developer who made it. Apple checks who the developer is before handing out the certificate, and macOS refuses to open an app whose signature has been tampered with.
HARD hasn’t yet recorded the signature on a real copy of NordVPN. Its Mac app shows who signed the copy you have.
Its bundle ID, the name macOS knows it by, is com.nordvpn.macos or com.nordvpn.NordVPN or com.nordvpn.osx-apple or com.nordvpn.osx. Download it only from nordvpn.com or the Mac App Store, not from an ad or a link someone sends you.
Fakes. In April 2024, criminals used a Bing advert and a copy of NordVPN’s website to distribute a Windows installer containing NordVPN and SecTopRAT malware.
What it connects to
In normal use, NordVPN talks to these places on the internet. A firewall that asks before apps connect, like the one in HARD’s Mac app, will show them.
| Address | Why |
|---|---|
*.nordvpn.com | VPN servers and service APIs. |
*.nordaccount.com | Sign-in and account management. |
napps-1.com | Alternative sign-in domain shown in the Mac setup guide. |
downloads.nordcdn.com | App downloads and connection files. |
What it can see
macOS asks you before an app can use these. You can change them any time in System Settings → Privacy & Security.
| Permission | What it’s for |
|---|---|
| Full Disk Access | Lets the website version’s Real-time protection scan files for malware. |
| Network Extensions | Supports VPN connections and the website version’s proxy extension for web protection. |
Security record
Problems with NordVPN or Nord Security in the last three years, newest first. Keeping the app up to date covers the ones that were fixed.
| When | What happened | Source |
|---|---|---|
| Cure53’s audit reported a Nord Account sign-in flaw that could let an attacker take over a session and access a private Meshnet; Cure53 verified the fix. | ↗ | |
| Cure53 reported that Threat Protection accepted invalid certificates for some encrypted web connections and allowed protection bypasses; it verified fixes for both flaws. | ↗ | |
| TunnelVision exposed a way for hostile networks to route traffic outside VPN connections, including NordVPN on Mac; NordVPN documents its “Stay invisible on a local network” setting as a mitigation. | ↗ |
References
- NordVPN official Mac download page nordvpn.com
- NordVPN macOS versions: website vs App Store support.nordvpn.com
- Installing NordVPN application on macOS support.nordvpn.com
- Resolving NordVPN Real-time protection issues on macOS support.nordvpn.com
- NordVPN for macOS release notes nordvpn.com
- NordVPN no-log policy nordvpn.com
- Finding NordVPN server names and addresses support.nordvpn.com
- NordVPN bundle identifier and signing information appcatalog.cloud
- NordVPN historical Mac app Info.plist records doesitarm.com
- NordVPN installer script showing current and older bundle identifiers forums.macrumors.com
- About Nord Security nordsecurity.com
- Nord Security headquarters in Vilnius nordsecurity.com
- Nord Security trademark and legal ownership information nordsecurity.com
- ThreatDown: Bing advert impersonating NordVPN threatdown.com
- Cure53 NordVPN apps, interfaces, extensions and account audit, 2025 sb.nordcdn.com
- Cure53 NordVPN apps, browser extensions and features audit, 2024 sb.nordcdn.com
- NordVPN explanation of TunnelCrack and TunnelVision mitigations support.nordvpn.com
- Sophos advisory recording the May 2024 TunnelVision disclosure sophos.com