Loading story…
Security researcher Zerotistic demonstrated that a Linux system could be enrolled into Apple’s Find My ecosystem and receive live location data intended for Apple devices. The method did not allow arbitrary tracking of Apple users; it exposed location information only for people who had already chosen to share their location with the Apple account used in the test. According to the reports, the researcher obtained Apple identity credentials, registered the Linux machine with Apple services, and convinced both Find My and Apple Push Notification service that the device was legitimate.
The enrollment reportedly abused Apple’s profile-registration workflow by submitting a custom PKCS#10 certificate signing request using a 2048-bit RSA key signed with SHA-1 to Apple’s authenticateDS endpoint, which then returned an IDS certificate. After subscribing the Linux device to the required Find My subservices and encryption settings, the researcher triggered delivery of an encrypted location key and used a Linux script to unwrap and decrypt location messages containing coordinates and timestamps. The full process reportedly took less than a week of experimentation, and Apple had not publicly responded to questions about the research at the time of publication.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
A security researcher published technical details showing how Apple’s private Find My People workflow could be reproduced on Linux, including GrandSlam authentication, IDS delegate token use, alloy service enrollment, and retrieval of shared location keys via APNS. The report said this was not a vulnerability requiring a patch because it only exposed location data already voluntarily shared with the researcher’s account.
After reporting on the demonstration, The Register asked Apple whether it was aware of the research and whether it planned to address the issue. Apple did not immediately respond to those questions.
A security researcher known as Zerotistic demonstrated that a Linux device could be enrolled into Apple’s Find My ecosystem and receive live location data intended for Apple devices. The method only exposed location data for people who had already chosen to share their location with the associated Apple account, not arbitrary Apple users.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcescworld.com
Open sourcetheregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers demonstrated that Apple’s **Find My** offline-finding network can be repurposed to transmit arbitrary data from devices without direct internet access by encoding message bits into crafted Bluetooth Low Energy broadcasts that nearby Apple devices forward to Apple’s backend. The proof of concept, dubbed **Send My**, used an `ESP32` transmitter and a macOS retrieval tool derived from **OpenHaystack** to recover the data through authenticated queries to Apple’s location-report service, achieving roughly **3 bytes per second** with end-to-end delays typically ranging from **1 to 60 minutes**. The work builds on reverse engineering behind **OpenHaystack**, an experimental framework for creating third-party Bluetooth accessories trackable through Apple’s Find My network. Researchers said the abuse is enabled by privacy-focused design choices that prevent Apple from linking broadcast public keys to owners, limiting authorization checks on report retrieval; they also noted prior security issues in the ecosystem, including **`CVE-2020-9986`**, which Apple fixed. The researchers proposed mitigations including BLE advertisement authentication and tighter rate limiting for location-report retrieval, while warning that experimental OpenHaystack firmware broadcasting a fixed public key can itself make accessories trackable by nearby devices.
Jul 24, 2026
A security researcher showed that the anti-reverse-engineering controls in an anonymized 64-bit iOS banking app dubbed **VIBA** could be bypassed despite extensive runtime self-protection. The app used obfuscation, encrypted strings, anti-jailbreak checks, anti-`Frida` logic, debugger detection, file-integrity validation, and large volumes of raw syscalls to resist analysis on modified devices. The researcher found several protections relied on weak patterns, including simple XOR string decryption, recognizable success and failure constants, and `ptrace` and `exit` syscalls that could be patched out, allowing checks for Frida files, port `27042`, injected dylibs, jailbreak artifacts, and `Info.plist` integrity to be defeated through static patching and runtime hooking. Separate malware analysis detailed a stealth-focused macOS backdoor known as **Tiny FUD** that masquerades as Apple-like processes, hides itself from Finder, and communicates with a command-and-control server at `69.197.175.10:9999`. The trojan collects host identifiers including UUID, username, hostname, and kernel version, executes remote commands, and captures screenshots every five minutes for exfiltration. Researchers said the sample also used self-signing with permissive entitlements, `DYLD`-related injection support, and cleanup routines to erase traces and terminate itself and child processes, and they published indicators including SHA-256 `d64e2688344c685c4156819156bdb15630d1168314b21c919eee5540b1beb54a`, related domains, and a YARA rule to aid detection.
Jul 12, 2026
Researchers disclosed **Operation Triangulation**, an iPhone espionage campaign that infected devices through iMessage and deployed a sophisticated spyware implant on iOS. Reporting tied the operation to a chain of **four zero-day vulnerabilities**, including flaws in Apple’s processing of messages and a hardware-based feature that enabled attackers to bypass protections that were largely undocumented outside Apple. Kaspersky said the malware targeted iPhones used by its employees, while later technical analysis and conference presentations detailed how the implant gained code execution, escalated privileges, and maintained stealth on compromised devices. The campaign quickly drew geopolitical attention after Russian authorities accused Apple of cooperating with the **NSA** in the spying operation, an allegation that was widely reported but not substantiated by public technical evidence. Subsequent coverage focused on the exploit kit sometimes referred to as **Coruna**, with Kaspersky later saying it had found **no signs** that the toolkit was created by the United States. The case remains notable for showing that attackers combined multiple iOS zero-days with obscure Apple hardware behavior to build a highly advanced surveillance platform against iPhone users.
Jul 12, 2026