Loading story…
A Department of Homeland Security audit found that U.S. Secret Service agents routinely used personal smartphones during foreign assignments because government-issued devices were too restricted for operational needs. Auditors said official devices often could not support basic tasks such as WhatsApp communication with foreign counterparts, internet research, group texting, or sending and receiving images, pushing personnel to use unmanaged personal devices despite policy prohibitions.
The audit warned that this practice exposed communications, personnel, and protectees to interception, tracking, malware, and other compromise risks, while also identifying weaknesses in the agency’s own mobile security controls. Findings included delayed deployment of mobile threat defense software, failures to wipe devices after foreign travel as required, and inadequate security assessment of a third-party archived messaging app apparently referring to TeleMessage, which the Secret Service stopped using in May 2025; the agency agreed to five recommendations covering device management, training, overseas device security, app testing, and enforcement of the ban on personal device use.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
Following the audit findings, the Secret Service agreed to five recommendations covering device management, training, overseas device security, app testing, and enforcement of the ban on personal device use. This marked the agency's formal response to the audit.
A DHS audit found that U.S. Secret Service agents routinely used personal smartphones during foreign assignments because government-issued devices were too restricted for operational needs. The audit also identified related mobile security weaknesses, including delayed mobile threat defense deployment, failures to wipe devices after foreign travel, and inadequate assessment of an archived messaging app.
The DHS inspector general report said U.S. Secret Service government devices used overseas did not have required mobile threat defense software until August 2025. The delayed deployment was cited as a security weakness that increased the risk to sensitive official communications.
Auditors said the Secret Service stopped using a third-party archived messaging app apparently resembling TeleMessage. The cessation was explicitly anchored as occurring in May 2025.
On July 13, 2024, shortly before the attempted assassination of Donald Trump in Butler, Pennsylvania, a Secret Service employee used a personal device to receive an image of the suspect because a government-issued phone could not support the need. The inspector general later cited the incident as an example of operational risk created by mobile device limitations.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcemalware.news
Open sourcenextgov.com
Open sourcetheregister.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourceismg-cdn.nyc3.cdn.digitaloceanspaces.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers and intelligence analysts have documented a series of incidents and trends highlighting the risks to mobile messaging accounts and devices. In December, a new form of WhatsApp account hijacking called GhostPairing was identified, where attackers trick users into linking an attacker-controlled browser to their WhatsApp device, potentially exposing sensitive information. Separately, researchers uncovered large-scale scraping of WhatsApp's contact discovery tool, resulting in the exposure of billions of phone numbers and associated profile data. Meanwhile, spyware threats targeting both iPhone and Android users have escalated, with zero-click attacks enabling adversaries to compromise devices and access encrypted messaging apps such as WhatsApp and Signal. Apple and Google responded by patching vulnerabilities believed to be exploited by commercial spyware like Predator, and the US CISA issued warnings about the active targeting of mobile messaging applications. In another high-profile case, the Iranian-linked Handala hacking group claimed to have fully compromised the mobile devices of two Israeli officials. However, forensic analysis revealed that only their Telegram accounts were breached, not the entire devices. The attackers likely used techniques such as SIM swapping, SS7 exploitation, and phishing to gain access, exposing gaps in session management and account security on encrypted messaging platforms. These incidents underscore the growing sophistication of attacks against mobile messaging services and the need for robust security measures, including privacy controls, passkey-encrypted backups, and vigilance against phishing and SIM-based attacks.
Jun 29, 2026
The U.S. Department of Defense has confirmed that foreign adversaries used commercially available location data to target and surveil American military personnel in operational theaters, including the Middle East. A newly disclosed U.S. Central Command letter said it had received multiple threat reports involving hostile actors exploiting data collected from phones and computers through the advertising and data-broker ecosystem. Lawmakers led by Senator Ron Wyden and Representative Pat Harrigan said the disclosures amount to the first public confirmation that purchased commercial geolocation data was used against U.S. troops in active war zones, and warned that the ad-tech industry now poses a **national security threat**. The reports say Pentagon safeguards were insufficient: service members were allowed to use personal devices in operational areas, no policy required geolocation to be disabled in active war zones, and even government-issued devices did not fully block advertising-related tracking. Critics said the risk had been documented for years, citing contractor briefings dating back to 2016, demonstrations tracing personnel from U.S. bases to a covert site in Syria, and later studies showing brokers could easily sell sensitive data on service members. The Pentagon said it is moving to a new mobile device management system to better disable location services, but lawmakers warned that broader use of bring-your-own-device policies and weak regulation of data brokers continue to leave troops exposed.
Jun 29, 2026
**StopICE**, an app used to track U.S. Immigration and Customs Enforcement (ICE) activity, reported a security incident after users received SMS messages urging them to uninstall the app. StopICE administrators attributed the activity to a “personal server” allegedly associated with a **U.S. Customs and Border Protection (CBP) agent** and said the attacker abused a **downstream carrier API** to spam users rather than compromising StopICE’s core systems. Public claims on social media alleged that attackers accessed and shared user data with law enforcement, including names, credentials, phone numbers, and location data; StopICE disputed holding most of that data and said the only potentially impacted population was users who opted into a **“location assist”** feature that collected geolocation to provide neighborhood-level alerts. Separate reporting amplified allegations that **over 100,000 users’** information (including GPS coordinates) was accessed and transmitted to U.S. federal agencies (**FBI, ICE, HSI**), and criticized StopICE leadership for allegedly not notifying users promptly. The same reporting period also included claims of a related compromise affecting another ICE-tracking app, **Eyes Up**, where attackers alleged the backend database lacked authentication and that they accessed/altered stored videos; no confirmation from Eyes Up was cited. Overall, the incident highlights risks from third-party messaging/telecom integrations and the potential safety impact of exposing activist-related location data, even when only a subset of users enable location-based features.
Jun 29, 2026