Loading story…
The Electronic Frontier Foundation warned that some Android apps have been quietly transmitting users’ precise location data to third-party advertising SDKs after users granted location access to the app itself. EFF said many developers may not realize embedded SDKs inherit the app’s permissions by default, allowing monetization components to collect and send sensitive location data unless developers explicitly disable that behavior.
The organization said it identified several affected Android apps with a combined about 60 million downloads, while cautioning that the exposed SDKs represent only a small slice of a broader ad-tech ecosystem that reaches billions of users. The data can flow to advertisers and data brokers and may be resold onward, including to governments or intelligence agencies, increasing surveillance, privacy, and breach risks; EFF argued that app-level consent does not amount to meaningful consent for third-party SDK collection and urged developers to turn off unnecessary location sharing.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
The Electronic Frontier Foundation reported that some Android apps were quietly sharing users' precise location data with third-party advertising SDKs by default after the apps received location permission. EFF said developers must explicitly disable this behavior and identified several affected apps totaling about 60 million downloads.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcescworld.com
Open sourcetechcrunch.com
Open sourceeff.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Defense has confirmed that foreign adversaries used commercially available location data to target and surveil American military personnel in operational theaters, including the Middle East. A newly disclosed U.S. Central Command letter said it had received multiple threat reports involving hostile actors exploiting data collected from phones and computers through the advertising and data-broker ecosystem. Lawmakers led by Senator Ron Wyden and Representative Pat Harrigan said the disclosures amount to the first public confirmation that purchased commercial geolocation data was used against U.S. troops in active war zones, and warned that the ad-tech industry now poses a **national security threat**. The reports say Pentagon safeguards were insufficient: service members were allowed to use personal devices in operational areas, no policy required geolocation to be disabled in active war zones, and even government-issued devices did not fully block advertising-related tracking. Critics said the risk had been documented for years, citing contractor briefings dating back to 2016, demonstrations tracing personnel from U.S. bases to a covert site in Syria, and later studies showing brokers could easily sell sensitive data on service members. The Pentagon said it is moving to a new mobile device management system to better disable location services, but lawmakers warned that broader use of bring-your-own-device policies and weak regulation of data brokers continue to leave troops exposed.
Jun 29, 2026
Independent research found **systemic privacy gaps in Chinese smart home iOS apps**, particularly around *bystander privacy* (people captured by cameras/mics who are not the account owner). A review of 49 apps in Apple’s mainland China App Store reported frequent mismatches between **App Store privacy labels**, privacy policies, and in-app settings, alongside broad collection of sensitive data and permissions (e.g., location, camera, microphone, contacts, Bluetooth, notifications) and identity-linked registration requirements (phone number + SMS verification). Separately, a technical proof-of-concept demonstrated how **Android’s `AccessibilityService` can be abused** as a “single-toggle” path to near-total device control without rooting or exploiting a vulnerability. The write-up describes rapid, silent enablement/abuse patterns that can lead to permission-like capabilities (screen capture, keylogging, gesture injection, data access, and remote control via a browser-based C2), highlighting how this legitimate accessibility feature is leveraged by *stalkerware/monitoring* ecosystems and why existing coverage often understates the practical impact.
Jun 29, 2026
Microsoft disclosed a severe **intent redirection** vulnerability in EngageLab’s third-party Android `EngageSDK` that could allow a malicious app on the same device to bypass Android sandbox protections and access sensitive data from affected apps. The flaw was tied to an exported activity, `MTCommonActivity`, which was introduced through the SDK into an app’s merged manifest and could process attacker-controlled intent URIs, causing intents to launch with the vulnerable app’s identity and permissions. Microsoft said the exposure was especially serious for cryptocurrency and digital wallet apps, with affected wallet applications alone accounting for more than **30 million installations**. Microsoft identified the issue in `EngageSDK` version `4.5.4`, reported it to EngageLab in April 2025, and escalated it to the Android Security Team in May 2025. EngageLab fixed the vulnerability in version `5.2.1`, released on November 3, 2025, while Google Play removed detected apps using vulnerable SDK versions and Android added automatic protections to mitigate the specific risk as developers update. Microsoft said it found **no evidence of in-the-wild exploitation**, but warned that insecure third-party mobile SDKs can create broad supply-chain exposure affecting more than **50 million app installations** overall.
Jun 29, 2026