Loading story…
Security researchers demonstrated that Apple’s Find My offline-finding network can be repurposed to transmit arbitrary data from devices without direct internet access by encoding message bits into crafted Bluetooth Low Energy broadcasts that nearby Apple devices forward to Apple’s backend. The proof of concept, dubbed Send My, used an ESP32 transmitter and a macOS retrieval tool derived from OpenHaystack to recover the data through authenticated queries to Apple’s location-report service, achieving roughly 3 bytes per second with end-to-end delays typically ranging from 1 to 60 minutes.
The work builds on reverse engineering behind OpenHaystack, an experimental framework for creating third-party Bluetooth accessories trackable through Apple’s Find My network. Researchers said the abuse is enabled by privacy-focused design choices that prevent Apple from linking broadcast public keys to owners, limiting authorization checks on report retrieval; they also noted prior security issues in the ecosystem, including CVE-2020-9986, which Apple fixed. The researchers proposed mitigations including BLE advertisement authentication and tighter rate limiting for location-report retrieval, while warning that experimental OpenHaystack firmware broadcasting a fixed public key can itself make accessories trackable by nearby devices.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
According to the OpenHaystack project documentation, Apple fixed CVE-2020-9986 after it was identified by the researchers. The flaw had allowed a malicious application to access location data.
Researchers at TU Darmstadt's Secure Mobile Networking Lab reverse engineered Apple's offline finding system and reported two vulnerabilities in it. One of the issues was CVE-2020-9986, which allowed a malicious application to access location data.
Positive Security disclosed a proof of concept showing Apple's Find My network could be abused to transmit arbitrary data by encoding it into crafted BLE messages relayed by nearby Apple devices. The write-up described an ESP32-based transmitter, a macOS retrieval application based on OpenHaystack, and argued the behavior stemmed from privacy-preserving design choices in Apple's system.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcepositive.security
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researcher **Zerotistic** demonstrated that a Linux system could be enrolled into Apple’s **Find My** ecosystem and receive live location data intended for Apple devices. The method did **not** allow arbitrary tracking of Apple users; it exposed location information only for people who had already chosen to share their location with the Apple account used in the test. According to the reports, the researcher obtained Apple identity credentials, registered the Linux machine with Apple services, and convinced both Find My and Apple Push Notification service that the device was legitimate. The enrollment reportedly abused Apple’s profile-registration workflow by submitting a custom `PKCS#10` certificate signing request using a 2048-bit RSA key signed with `SHA-1` to Apple’s `authenticateDS` endpoint, which then returned an IDS certificate. After subscribing the Linux device to the required Find My subservices and encryption settings, the researcher triggered delivery of an encrypted location key and used a Linux script to unwrap and decrypt location messages containing coordinates and timestamps. The full process reportedly took less than a week of experimentation, and Apple had not publicly responded to questions about the research at the time of publication.
Aug 21, 2026
Apple said it was expanding protections against unwanted AirTag tracking by improving alert precision, adding earlier warnings for unknown accessories, updating setup messaging to warn that tracking people without consent is a crime in many regions, and planning features such as **Precision Finding** for unknown AirTags, louder sounds, and clearer alert wording. The company framed the changes as part of a broader effort to deter stalking and help users identify and disable suspicious trackers. Security researchers then demonstrated that those safeguards could be evaded with a custom **Find My** beacon built from OpenHaystack and an `ESP32`, effectively creating a stealth AirTag clone. By rotating through thousands of public keys, the proof of concept reportedly tracked an iPhone user for more than five days without triggering Apple’s unwanted-tracking alerts or AirTag sound defenses, while Apple’s **Tracker Detect** app did not find it in active scans and **AirGuard** only detected it manually. The findings argued that Apple’s mitigations were too focused on genuine AirTags and should instead be enforced at the **Find My** ecosystem level to address modified tags and third-party clones.
Jul 24, 2026
Apple and Google have rolled out a new cross-platform standard that warns users on **iOS** and **Android** when an unknown Bluetooth tracking device appears to be moving with them. The feature is designed to counter stalking and other misuse of consumer location tags, including Apple AirTag-compatible devices and other trackers that implement the industry specification **Detecting Unwanted Location Trackers**. Apple said iPhone users running **iOS 17.5** will see "Item Found Moving With You" alerts, while Google said Android 6.0+ devices will support similar "Tracker traveling with you" notifications and provide options to locate and disable the device. The rollout comes amid broader scrutiny of how Bluetooth-based location networks can be abused beyond dedicated tags. KrebsOnSecurity reported that some Wi-Fi routers and other Bluetooth-enabled devices can effectively behave like AirTags because Apple’s **Find My** network may infer their location from nearby Apple devices, creating privacy concerns if hardware is moved or repurposed without an owner’s knowledge. Together, the announcements and reporting highlight a wider effort to reduce covert tracking risks across mobile ecosystems while acknowledging that everyday connected devices can also become part of large-scale location-finding networks.
Jul 12, 2026