Apple Air Tag Bug Enables ‘Good Samaritan’ Attack
Summary: Security consultant Bobby Rauch found that Apple's AirTag Lost Mode lets a user inject arbitrary code into the phone number field, so a finder who scans a lost tag can be redirected from found.apple.com to an iCloud phishing page or other malicious site. Rauch reported the bug to Apple on June 20, and after three months of being told the company was still investigating, Apple said last Thursday it planned to fix the flaw in an upcoming update and asked him not to discuss it publicly.
Bottom line: The attack needs no exploit kit and no user mistake beyond doing the helpful thing: a $30 tag dropped in a parking lot turns a Good Samaritan's own phone into the delivery vehicle, the same pickup-and-plug instinct that carried Stuxnet into an air-gapped enrichment facility and breached U.S. military computers in 2008.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026