Loading story…
Apple announced the integration of digital passports into Apple Wallet with iOS 26, expanding the use of digital IDs on mobile devices. As digital IDs and mobile driver’s licenses become more widespread, security experts warn of new risks, including threats from malicious apps, malware, inconsistent privacy protections, and potential data misuse. While these digital credentials offer cryptographic security and selective disclosure features, their adoption raises concerns about safeguarding sensitive personal information. Organizations and users are advised to consider both the convenience and the emerging security challenges associated with mobile digital IDs.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers highlighted that the growing use of mobile driver's licenses and other digital IDs creates new attack surfaces, including device compromise, identity theft, and privacy exposure tied to mobile wallets. The warning framed digital ID adoption as a security issue accompanying increased convenience.
Apple disclosed that iOS 26 will add digital ID capabilities in Apple Wallet, including support for passports alongside existing mobile driver's license functionality. The announcement expanded the scope of digital identity on iPhones beyond state-issued IDs.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple has introduced a new feature allowing users to store digital versions of their passports within the Apple Wallet app on iPhones. This Digital ID functionality enables users to scan the photo page and embedded chip of their physical passport, verify their identity with a selfie, and add the digital passport to their device. The feature is currently accepted at over 250 TSA checkpoints across the United States, providing a convenient way for travelers to prove their identity for domestic flights. Despite the convenience, the digital passport stored in Apple Wallet does not replace the need for a physical passport, especially for international travel or border crossings. The digital version is intended as an additional form of identification, particularly useful for those without a REAL ID-compliant driver's license or state ID. This rollout follows Apple's earlier support for digital driver's licenses and state IDs in select states, further expanding the capabilities of the Wallet app for secure digital identification.
Jun 29, 2026
A recent large-scale analysis of 50,000 mobile applications has revealed that over 77% of these apps leak personally identifiable information due to insecure data handling and insufficient privacy controls. The study found that many iOS applications fail to include required privacy manifests, while Android apps often circumvent explicit data-safety disclosures, creating significant blind spots in user privacy protections. These vulnerabilities are particularly concerning given the central role mobile devices play in daily communications and financial transactions, making users susceptible to tracking, profiling, and data theft. The research underscores the systemic nature of privacy risks in the mobile app ecosystem, with both platforms exhibiting gaps in transparency and compliance. In parallel, regulatory efforts to protect minors online are introducing new privacy challenges, as exemplified by Texas's SB 2420 law, which mandates age assurance for app store users and developers. Apple has voiced strong concerns that such laws require the collection and storage of sensitive personal information, such as government IDs, even for benign app downloads, thereby increasing the risk of data breaches. Starting January 1, 2026, Apple will require new account holders to confirm they are over 18, and minors will need parental consent for app downloads and purchases, further expanding the amount of sensitive data collected. Apple argues that these requirements should be limited to apps where age verification is truly necessary, warning that blanket mandates could have unintended privacy consequences. The complexity is heightened by the patchwork of state-level laws, with similar regulations set to take effect in Utah and Louisiana, compelling developers to adapt to varying compliance standards. The risks of such data collection are not theoretical; a recent breach at a third-party provider for Discord, which handled age verification, resulted in the exposure of sensitive government ID images. This incident illustrates the tangible dangers of accumulating large repositories of personal data for regulatory compliance. The convergence of insecure app data practices and regulatory-driven data collection amplifies the threat landscape for mobile users. Both industry and regulators face the challenge of balancing user safety, especially for minors, with the imperative to minimize unnecessary data exposure. The findings highlight the urgent need for stronger privacy-by-design principles in app development and more nuanced regulatory approaches that do not inadvertently increase user risk. As mobile platforms continue to evolve, ongoing vigilance and collaboration between stakeholders will be essential to safeguard user privacy. The situation calls for immediate action from app developers, platform providers, and policymakers to address these multifaceted privacy threats. Users are advised to remain cautious about the permissions they grant and the information they share with mobile applications. The broader industry must prioritize transparency, user control, and robust security measures to restore trust in the mobile app ecosystem.
Jun 29, 2026
Indian officials and agencies are pushing to broaden the use of digital identity in both public and private contexts, while explicitly raising cybersecurity and accountability concerns. In Hyderabad, Police Commissioner **V.C. Sajjanar** publicly argued that autonomous **AI agents** operating in critical sectors (e.g., banks, hospitals, power grids) should be issued a verifiable *digital identity* and be subject to strong **logging and traceability** so investigators can determine “which agent opened which file,” what changes were made, and where data was sent—framing the need as a safeguard against errors and the risk of **cybercriminals hijacking agent behavior**. Separately, India’s **UIDAI** is expanding **Aadhaar** into more day-to-day use via a new Aadhaar app and an **offline verification** framework intended to reduce reliance on real-time checks against the central database, while enabling *selective disclosure* (e.g., proving age without sharing full birthdate). The initiative also extends Aadhaar into consumer ecosystems (including planned **Google Wallet** integration and discussions with **Apple Wallet**) and into operational deployments such as policing and hospitality—e.g., Ahmedabad City Crime Branch integrating Aadhaar-based offline verification with the **PATHIK** guest-monitoring platform—prompting critics to reiterate concerns about **security, consent, and privacy** as Aadhaar’s footprint grows.
Jun 29, 2026