Loading story…
Apple and Google have begun rolling out end-to-end encrypted Rich Communication Services (RCS) messaging for cross-platform chats between iPhone and Android users, bringing stronger privacy protections to a protocol intended to replace traditional SMS. The beta rollout applies to iPhones running iOS 26.5 on supported carriers and Android devices using the latest Google Messages, with encryption enabled by default and expanding over time to new and existing RCS conversations.
The feature is based on GSMA RCS Universal Profile 3.0 and uses the Messaging Layer Security (MLS) protocol, which is designed to prevent Apple, Google, and carriers from reading message contents while they are in transit. Availability still depends on carrier support and updated client software, so encrypted RCS will not reach all users immediately, and privacy advocates noted that metadata may still be exposed and cloud backups may remain unencrypted unless users enable additional protections such as Apple Advanced Data Protection.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Apple released iOS 26.5 with support for end-to-end encrypted Rich Communication Services messaging, enabling encrypted chats between Apple Messages and Google Messages where carriers and software versions support it.
Google and Apple announced that end-to-end encrypted RCS messaging began rolling out in beta for cross-platform conversations between iPhone and Android users. The rollout applies to supported iPhone users on iOS 26.5 and Android users on the latest Google Messages, with encryption enabled by default over time.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
eff.org
Open sourceblog.google
Open sourceapple.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple released an *iOS/iPadOS 26.4 developer beta* that adds **end-to-end encryption (E2EE) for RCS messaging** in limited testing, with availability constrained by device/carrier support and currently limited to **Apple-to-Apple** RCS conversations. The implementation is tied to upgrading to **RCS Universal Profile 3.0** built on the **Messaging Layer Security (MLS)** protocol, aligning with the GSMA’s prior move to standardize E2EE for RCS. The beta also expands platform hardening by allowing apps to opt into the full protections of **Memory Integrity Enforcement (MIE)** (beyond the previously available “Soft Mode”), and reporting indicates Apple may enable **Stolen Device Protection** by default in this release line. Google released the first *Android 17 beta* with multiple privacy/security changes aimed at tightening network and cryptographic defaults and improving user control. Android 17 **deprecates** the `android:usesCleartextTraffic` manifest attribute; apps targeting Android 17+ that set `usesCleartextTraffic="true"` without a **Network Security Configuration** will have cleartext traffic blocked by default, pushing developers toward more granular policy via configuration files. The beta also introduces a public **HPKE (Hybrid Public Key Encryption)** Service Provider Interface, adds user preference controls for **VoIP call history integration**, and expands **Wi‑Fi ranging** for proximity detection and secure peer-to-peer discovery.
Jun 29, 2026
Google has rolled out **end-to-end encryption (E2EE)** for Gmail on Android and iOS, extending a capability that had previously been limited to the web for eligible Google Workspace customers. The feature lets enterprise users compose and read encrypted email directly in the Gmail mobile app, with messages encrypted on the sender’s device and decrypted only on the recipient’s device so that Google cannot access message contents in plaintext on its servers. The mobile rollout is available to organizations using **Google Workspace Enterprise Plus** with **Assured Controls** or **Assured Controls Plus**, after enablement by Workspace administrators and users. Google said the update is intended to reduce dependence on third-party encryption tools and secure portals, particularly in regulated industries such as healthcare, finance, and defense-related contracting. The service is built on Google Workspace **client-side encryption**, which keeps encryption keys under customer control outside Google infrastructure and supports compliance needs including data sovereignty, `HIPAA`, and export controls; recipients outside Gmail or without the Gmail mobile app can access encrypted messages through a web browser.
Jun 29, 2026
The Electronic Frontier Foundation launched **“Encrypt It Already”**, a campaign pressuring major consumer tech providers to expand and complete **end-to-end encryption (E2EE)** commitments and make protections easier to use. The campaign tracks where encryption is promised but not delivered (e.g., E2EE for Facebook group messages, interoperable encrypted RCS messaging promised by **Apple** and **Google**, and E2EE for Bluesky DMs), where encryption exists but is not enabled by default (e.g., Telegram encrypted chats, WhatsApp backups, and Ring camera footage settings), and where additional encrypted storage and controls are being urged (e.g., encrypted backups for Google Authenticator and broader encrypted Android backups). EFF’s stated goal is to shift control of communications and stored data toward users by pushing vendors to ship E2EE features, enable them by default, and broaden encrypted data coverage. Separately, consumer privacy concerns continue to shape adoption and trust in data-collecting devices and platforms. A Clutch survey cited in reporting found **74%** of respondents are concerned about how wearable devices handle personal data, and only **58%** are confident their wearable protects their data—sentiment that may drive brand switching decisions. In parallel, an Apple-focused article on “privacy rules” promoted user configuration steps within the iPhone ecosystem (e.g., Safari anti-tracking features, a dedicated Passwords app, and other privacy controls), but it does not describe a specific incident or vulnerability and reads primarily as general privacy guidance tied to Data Privacy Day.
Jun 29, 2026