Loading story…
The U.S. Secret Service is investigating a nearly three-minute Persian-language video with English captions that appears to map President Donald Trump’s motorcade routes in Florida and New York and identify possible assassination opportunities. The video, reportedly titled "Where to Kill Trump?!", describes alleged travel patterns between locations including Mar-a-Lago, Trump Tower, Palm Beach International Airport, and LaGuardia Airport, and highlights at least one location as a potential attack point. Some reports said the production used polished, possibly AI-generated graphics, while U.S. officials have not confirmed the video’s authenticity, circulation, or producer.
The material surfaced amid heightened U.S.-Iran tensions and longstanding Iranian threats against Trump tied to the 2020 killing of Qasem Soleimani. Social media posts attributed the video to Iran’s state-backed Fars News Agency, but that claim remains unverified. Former Secret Service officials said investigators are likely conducting forensic analysis to determine the source and credibility of the video and to decide whether any protective operations should be adjusted if the information proves actionable.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
The U.S. Secret Service is examining a Persian-language video that appears to map President Donald Trump's motorcade routes in Florida and New York and suggest possible assassination opportunities. U.S. officials had not confirmed the video's producer, circulation, or authenticity at the time of reporting, though some social media posts attributed it to Iran's state-backed Fars News Agency.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcenextgov.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. authorities investigated suspected Iranian cyber activity targeting the 2024 presidential race after Donald Trump’s campaign said it had been hacked and internal materials were leaked, including a vetting document on Sen. JD Vance. The FBI opened a national security investigation into attempts aimed at a Trump associate and advisers to the Biden-Harris campaign, while the Harris campaign said it had faced an unsuccessful spear-phishing attempt and found no evidence of a breach. The activity fit a broader Iranian influence and intrusion effort tied to the election. Microsoft reported Iran-linked operators were using fake news sites and cyber operations to meddle in U.S. politics, and the White House condemned any foreign interference. The case later escalated from investigation to prosecution, with U.S. authorities charging Iranian operatives over the hacking of the Trump campaign.
Jun 29, 2026
A new threat assessment warns that the Iran war is likely to increase physical security risks in the United States over the next year, driven mainly by second-order political and social effects that mobilize homegrown violent extremists, domestic violent extremists, and lower-capability Iran-nexus actors. The report says **Islamic State supporters** are the most likely perpetrators of mass-casualty attacks, while anti-government, anti-authority, anarchist, and neo-Nazi accelerationist extremists are expected to continue targeted violence, sabotage, and plotting against officials, facilities, and critical infrastructure. The assessment says Iran is more likely to **inspire or guide** attacks in the US than to conduct sophisticated, centrally directed operations, noting that recent US-linked plots tied to Tehran have been aspirational, low-sophistication, and often dependent on financially motivated proxies. Likely targets include US and Israeli government or military-linked entities, **Jewish communities**, immigration enforcement, critical infrastructure, and high-profile public officials, while emerging tactics include greater experimentation with **IEDs**, 3D-printed weapons, UAV-borne explosives, and generative AI-assisted attack planning.
Aug 13, 2026
Reporting indicates **state-linked operators are compromising or attempting to compromise internet-exposed traffic and security cameras** to support real-world military and intelligence operations in the Israel–Iran conflict. Multiple outlets cited by *Schneier on Security* describe **Israel hacking Iranian traffic cameras** to help track movements and assist in the killing of Iranian leadership, with broader context reportedly covered by *The New York Times* on the overall intelligence operation. Separately, *Risky Business* reports a **spike in scanning and exploitation attempts against Hikvision and Dahua cameras** across Israel and several Middle East countries (including Qatar, Bahrain, Kuwait, the UAE, and Cyprus), attributed to a group tied to the **Iranian government**. Check Point assessed the activity included attempts to exploit **older, known vulnerabilities**, and analysts believe the intent was to obtain street-level imagery for **targeting support, battle-damage assessment, and propaganda**; similar camera-focused activity was also noted during earlier periods of heightened tension and prior regional strikes, reinforcing camera compromise as an emerging, repeatable battlefield tactic.
Jun 29, 2026