Loading story…
A collaborative media investigation has revealed that First Wap, a Jakarta-based company, has been providing surveillance-as-a-service through its product Altamides, which exploits vulnerabilities in the Signalling System 7 (SS7) protocol. Altamides, short for Advanced Location Tracking and Deception System, enables the tracking of mobile phones and the redirection of text messages or phone calls without the need to deploy malware on target devices. The investigation, initiated by Lighthouse Reports, uncovered a leaked dataset containing 1.5 million Altamides queries from 2007 to 2014, spanning 160 countries and involving 14,000 phone numbers. Analysis of this dataset provided detailed insights into the global reach and use of Altamides, including the targeting of individuals in the United States, United Kingdom, and Australia. Notably, the dataset included high-profile American targets such as Erik Prince, Anne Wojcicki, journalist Adam Ciralsky, Raytheon executives, and employees of telecom and cybersecurity firms. Despite the general tendency of spyware vendors to avoid targeting U.S. individuals, evidence showed that Altamides was used against several American citizens. First Wap's clientele reportedly included government agencies from Belarus, Indonesia, Malaysia, Nigeria, Saudi Arabia, Singapore, the United Arab Emirates, and Uzbekistan. The product was also used in corporate investigations, indicating its appeal beyond state actors. The investigation highlights that, while major spyware vendors have faced significant crackdowns, smaller firms like First Wap continue to operate and offer potent surveillance capabilities. Altamides leverages inherent weaknesses in global telecommunications infrastructure, specifically SS7, which remains widely used and vulnerable. The lack of need for malware deployment makes detection and prevention more challenging for targeted individuals and organizations. The exposure of the historical dataset has provided rare transparency into the operational scope and methods of such surveillance firms. The findings underscore the persistent risks posed by surveillance-as-a-service providers, especially those operating under the radar of international regulatory efforts. The investigation raises concerns about the adequacy of current oversight and the ongoing exploitation of legacy telecom protocols. It also demonstrates the global nature of surveillance-for-hire, with both governmental and private sector clients seeking access to these capabilities. The continued existence and activity of firms like First Wap suggest that the surveillance industry remains resilient despite increased scrutiny of larger players. The revelations have prompted renewed calls for stronger international cooperation to address vulnerabilities in telecommunications infrastructure and to regulate the surveillance technology market. The case of First Wap and Altamides serves as a stark reminder of the evolving landscape of digital surveillance and the challenges in curbing its misuse.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
Articles published by Risky Business and Lawfare reported that smaller surveillance companies had, for the time being, escaped a broader regulatory or policy crackdown. The references do not provide specific underlying event details, affected firms, or a dated government action beyond this reported status.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citizen Lab reported two covert surveillance campaigns that exploited weaknesses in global mobile signalling infrastructure to track targets’ locations across borders. The operations, labeled **STA1** and **STA2**, abused legacy `SS7` and newer `Diameter` protocols, with one campaign also using **SIMjacker-style zero-click binary SMS** and malicious SIM Toolkit commands to try to turn a handset into a covert beacon. Researchers said the activity marks the first time real-world attack traffic has been directly linked to mobile operator signalling systems, showing attackers impersonating operators, rotating identities across countries, manipulating routing paths, and evading signalling firewalls while exploiting weak authentication and trusted telecom interconnect relationships. The campaigns were observed using operator identifiers and infrastructure tied to networks in Europe, Africa, the Middle East, and Asia, including telecoms cited as transit or entry points such as **019Mobile**, **Tango Networks U.K.**, and **Airtel Jersey**. Citizen Lab said the activity is consistent with commercial surveillance platforms serving government intelligence customers, and one campaign may have links to an Israeli geo-intelligence provider, though no vendor or operator was conclusively attributed. The researchers warned that abuse of leased or intermediary signalling access, combined with long-standing flaws in roaming trust models, has enabled large volumes of hard-to-detect location tracking that may persist for years across 3G, 4G, and 5G-connected environments.
Aug 24, 2026
Investigations and legal filings described a growing **mercenary spyware** market in which private vendors developed and sold intrusion capabilities to government customers, with **NSO Group** emerging as the best-known example but not the only one. Reporting tied NSO’s **Pegasus** spyware to attacks on activists, journalists, and government personnel, including the targeting of UAE activist Ahmed Mansoor and more than **1,400 devices** via a WhatsApp exploit that reportedly required no answer from the victim. Microsoft, Google, Cisco, GitHub, LinkedIn, VMware, and others backed WhatsApp’s lawsuit against NSO, arguing the company should not receive sovereign immunity for operating as a private offensive cyber actor, while broader reporting said Facebook had identified **seven** spyware firms targeting roughly **50,000** people across its platforms. Separate investigations showed the industry stretching beyond NSO into Europe and Asia. Lighthouse Reports linked Italy’s **RCS Lab** and its Tykelab unit to covert mobile-phone tracking through telecom signaling weaknesses and to **Hermit** spyware infrastructure, while Citizen Lab and Motherboard connected a fake WhatsApp phishing campaign to Italian vendor **Cy4Gate** and its **Epeius** lawful-intercept product. Earlier reporting on **Hacking Team** and allegations about **APT17** selling stolen data underscored how surveillance and intrusion capabilities have been commercialized, repackaged, and marketed across borders, despite repeated scandals, lawsuits, and sanctions aimed at curbing abuse.
Aug 15, 2026
Lookout reported multiple mobile surveillance campaigns targeting officials, diplomats, military personnel, activists, and other high-value individuals across South Asia and the Middle East. In one campaign, the **Confucius APT** was linked with high confidence to the Android spyware families **Hornbill** and **SunBird**, which targeted people connected to Pakistan’s military and nuclear organizations as well as election officials in Kashmir. The malware could exfiltrate messages, geolocation, media, call records, documents, and **WhatsApp** content, while insecure command-and-control servers exposed more than **18 GB** of stolen data tied to victims in India, Pakistan, Kazakhstan, Europe, the United States, and the UAE. Lookout also detailed the earlier **Stealth Mango** and **Tangelo** surveillance operation, attributed to members of the Pakistani military, which targeted Android and iOS devices used by government officials, diplomats, military personnel, and activists in Pakistan, Afghanistan, India, Iraq, and the UAE. That campaign relied mainly on phishing through fake Facebook personas and, in some cases, physical access rather than exploits, and collected government communications, travel details, identity documents, GPS data, legal and medical records, and photos from sensitive meetings. Lookout said Google updated **Google Play Protect** and removed malicious Android apps from affected devices, while the research also tied the operators to freelance developers associated with other commercial or commodity spyware tools.
Aug 15, 2026