Loading story…
A Purdue University-led analysis of more than 220 mobile apps marketed to US service members found extensive third-party code exposure, with 64% of the apps containing embedded SDKs and 40% collecting or sharing more data than their Apple App Store or Google Play privacy disclosures stated. Researchers identified 76 SDKs in total, including components linked to companies in China, Russia, Israel, India, and Germany, and reported that roughly 7% of the apps included third-party code from countries the Pentagon considers adversarial.
The findings raised supply-chain and surveillance concerns because apps aimed at troops can access sensitive information about where service members live, work, and deploy. Twelve apps, including several associated with state National Guard organizations, contained Huawei HMS Core, though researchers said they did not observe data being transmitted to Huawei servers. The study also found that foreign code was sometimes introduced indirectly through software dependencies, underscoring how military-targeted apps can inherit hidden risk from commercial development tools.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
A Purdue University-led analysis of more than 220 mobile apps built and marketed for military users found that many included third-party SDKs, with some code traced to China, Russia, and other foreign countries. The researchers also reported that many apps collected or shared more data than disclosed in app store privacy listings, raising supply-chain, privacy, and national security concerns.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcearstechnica.com
Open sourcewired.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Defense has confirmed that foreign adversaries used commercially available location data to target and surveil American military personnel in operational theaters, including the Middle East. A newly disclosed U.S. Central Command letter said it had received multiple threat reports involving hostile actors exploiting data collected from phones and computers through the advertising and data-broker ecosystem. Lawmakers led by Senator Ron Wyden and Representative Pat Harrigan said the disclosures amount to the first public confirmation that purchased commercial geolocation data was used against U.S. troops in active war zones, and warned that the ad-tech industry now poses a **national security threat**. The reports say Pentagon safeguards were insufficient: service members were allowed to use personal devices in operational areas, no policy required geolocation to be disabled in active war zones, and even government-issued devices did not fully block advertising-related tracking. Critics said the risk had been documented for years, citing contractor briefings dating back to 2016, demonstrations tracing personnel from U.S. bases to a covert site in Syria, and later studies showing brokers could easily sell sensitive data on service members. The Pentagon said it is moving to a new mobile device management system to better disable location services, but lawmakers warned that broader use of bring-your-own-device policies and weak regulation of data brokers continue to leave troops exposed.
Jun 29, 2026
A coalition of agencies from the U.K., Australia, Canada, Germany, New Zealand, and the United States published advisories identifying the mobile spyware families **BadBazaar** and **Moonshine** in dozens of legitimate-looking apps. The malware was disguised as Android prayer apps, messaging tools, PDF readers, and utility apps, and one iOS app, **`TibetOne`**, was also named. Officials said the spyware targeted civil society groups and people connected to issues viewed by the Chinese state as sensitive, including Uyghur, Tibetan, Taiwanese, Hong Kong democracy, and Falun Gong communities. Technical analysis from the Australian Cyber Security Centre said **Moonshine** was distributed through trojanized apps, social media, messaging platforms, and in some cases official app stores, while **BadBazaar** included Android and iOS variants such as **BadSolar** and **BadSignal**. The spyware can collect files, chats, photos, location data, audio, and device information, giving operators broad surveillance access to cameras and microphones. Investigators also reported infrastructure overlaps tied to social-engineering assets, reused registration details, SSL certificate artifacts, and activity previously associated with **TA413**, **APT5**, **APT14**, and infrastructure linked to **UPSEC**.
Jun 29, 2026
Researchers and journalists reported multiple cases in which Android spyware linked to government actors was distributed through official app stores, including **Google Play**. In one campaign, Lookout said North Korean operators deployed spyware it tracks as **KoSpy** through at least one Google Play app and additional listings on APKPure. The malware was built for surveillance, with capabilities to collect **SMS messages, call logs, location data, files, keystrokes, Wi-Fi details, and installed apps**, and to **record audio, take photos, and capture screenshots**. Lookout assessed the operation as highly targeted, likely aimed at specific individuals in South Korea, and linked supporting infrastructure to activity associated with **APT37** and **APT43**. A separate earlier case involved **Exodus**, spyware that researchers found hidden in Google Play apps and described as government malware. Together, the incidents show that official Android marketplaces have been used to deliver surveillance tools masquerading as legitimate apps. Google said it removed the identified KoSpy apps from Google Play, disabled related Firebase projects, and that **Google Play Protect** blocks known versions of the malware.
Jun 29, 2026