Bad Connection: Uncovering Global Telecom Exploitation by Covert Surveillance Actors

2026-04-27

Citizen Lab found two surveillance vendors exploiting SS7 and Diameter signalling to track phones globally. One campaign hit a VVIP executive's phone across 11 operator identities in nine countries in four hours, switching protocols to dodge firewalls. A second used a malicious SMS with hidden SIM commands to turn a phone into a tracking beacon.