Loading story…
Apple said it was expanding protections against unwanted AirTag tracking by improving alert precision, adding earlier warnings for unknown accessories, updating setup messaging to warn that tracking people without consent is a crime in many regions, and planning features such as Precision Finding for unknown AirTags, louder sounds, and clearer alert wording. The company framed the changes as part of a broader effort to deter stalking and help users identify and disable suspicious trackers.
Security researchers then demonstrated that those safeguards could be evaded with a custom Find My beacon built from OpenHaystack and an ESP32, effectively creating a stealth AirTag clone. By rotating through thousands of public keys, the proof of concept reportedly tracked an iPhone user for more than five days without triggering Apple’s unwanted-tracking alerts or AirTag sound defenses, while Apple’s Tracker Detect app did not find it in active scans and AirGuard only detected it manually. The findings argued that Apple’s mitigations were too focused on genuine AirTags and should instead be enforced at the Find My ecosystem level to address modified tags and third-party clones.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Positive Security disclosed research showing a custom Find My beacon built with OpenHaystack and an ESP32 could evade Apple's unwanted-tracking protections for more than five days by rotating through thousands of public keys. The researchers also reported that Apple's Tracker Detect app did not find the stealth tracker in active scans, while AirGuard detected it only in manual scan mode.
Apple published an update on unwanted tracking that outlined existing AirTag safety features and announced additional measures intended to deter misuse and improve alerts for people who may be tracked without consent.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple and Google have rolled out a new cross-platform standard that warns users on **iOS** and **Android** when an unknown Bluetooth tracking device appears to be moving with them. The feature is designed to counter stalking and other misuse of consumer location tags, including Apple AirTag-compatible devices and other trackers that implement the industry specification **Detecting Unwanted Location Trackers**. Apple said iPhone users running **iOS 17.5** will see "Item Found Moving With You" alerts, while Google said Android 6.0+ devices will support similar "Tracker traveling with you" notifications and provide options to locate and disable the device. The rollout comes amid broader scrutiny of how Bluetooth-based location networks can be abused beyond dedicated tags. KrebsOnSecurity reported that some Wi-Fi routers and other Bluetooth-enabled devices can effectively behave like AirTags because Apple’s **Find My** network may infer their location from nearby Apple devices, creating privacy concerns if hardware is moved or repurposed without an owner’s knowledge. Together, the announcements and reporting highlight a wider effort to reduce covert tracking risks across mobile ecosystems while acknowledging that everyday connected devices can also become part of large-scale location-finding networks.
Jul 12, 2026
Security researchers demonstrated that Apple’s **Find My** offline-finding network can be repurposed to transmit arbitrary data from devices without direct internet access by encoding message bits into crafted Bluetooth Low Energy broadcasts that nearby Apple devices forward to Apple’s backend. The proof of concept, dubbed **Send My**, used an `ESP32` transmitter and a macOS retrieval tool derived from **OpenHaystack** to recover the data through authenticated queries to Apple’s location-report service, achieving roughly **3 bytes per second** with end-to-end delays typically ranging from **1 to 60 minutes**. The work builds on reverse engineering behind **OpenHaystack**, an experimental framework for creating third-party Bluetooth accessories trackable through Apple’s Find My network. Researchers said the abuse is enabled by privacy-focused design choices that prevent Apple from linking broadcast public keys to owners, limiting authorization checks on report retrieval; they also noted prior security issues in the ecosystem, including **`CVE-2020-9986`**, which Apple fixed. The researchers proposed mitigations including BLE advertisement authentication and tighter rate limiting for location-report retrieval, while warning that experimental OpenHaystack firmware broadcasting a fixed public key can itself make accessories trackable by nearby devices.
Jul 24, 2026
Researchers from the Georgia Institute of Technology have uncovered significant security flaws in Tile's popular Bluetooth location trackers, raising concerns about user privacy and the potential for malicious tracking. The investigation revealed that each Tile device broadcasts an unencrypted, static MAC address along with a unique identifier, making it possible for any nearby Bluetooth-enabled device or radio-frequency antenna to intercept these signals. Unlike competing trackers that use temporary, rotating IDs to obscure the device's identity, Tile's approach leaves the MAC address unchanged, which allows for persistent tracking of the device and, by extension, its owner. The researchers also found that while Tile does rotate its unique ID, the method used is weak and can be easily circumvented, enabling continuous monitoring. Data collected by nearby devices is sent to Life360's servers without encryption, and the researchers believe this information may be stored in cleartext, further compounding privacy risks. This design flaw means that an attacker only needs to capture a single broadcast from a Tile device to fingerprint and track it indefinitely. The scale of the issue is significant, with approximately 88 million Tile trackers in use worldwide, amplifying the potential impact. The vulnerabilities are not mitigated by the safeguards Tile introduced in 2023, which were intended to prevent misuse by owners but do not address third-party tracking via Bluetooth sniffers. Such sniffers are widely available and commonly used in retail environments and smart-home setups, making the exploitation of these flaws trivial for both individuals and organizations. The researchers warn that these weaknesses could be exploited by stalkers, thieves, or other malicious actors to follow individuals without their knowledge. The lack of encryption in both the device broadcasts and the communication with Life360's infrastructure means that sensitive location data could be intercepted or misused in the event of a breach. The findings highlight a broader issue in the rapidly growing Bluetooth tracker market, where security and privacy considerations have not kept pace with adoption. The researchers emphasize that the current implementation allows for mass surveillance if Tile trackers are caught in large-scale scans. They also note that other tracker systems use more robust encryption and key management to protect user privacy, underscoring Tile's lag in adopting industry best practices. The exposure of static MAC addresses and weak ID rotation not only facilitates stalking but also opens the door to broader privacy violations and potential data breaches. The researchers' warnings serve as a call to action for both manufacturers and users to prioritize security in the design and use of location-tracking devices. Life360, the parent company of Tile, has not yet announced any immediate remediation steps in response to these findings. The incident underscores the importance of rigorous security assessments for consumer IoT devices, especially those with the potential to impact personal safety and privacy on a large scale.
Jun 29, 2026