Technology

Thousands of iPhone apps expose data inside Apple App Store

Published

2 months ago

January 30, 2026

Thousands of iPhone apps expose data inside Apple App Store

NEWYou can now listen to Fox News articles!

Apple often promotes the App Store as a secure place to download apps. The company highlights strict reviews and a closed system as key protections for iPhone users. That reputation now faces serious questions.

New research shows that thousands of iOS apps approved by Apple contain hidden security flaws. These flaws can expose user data, cloud storage and even payment systems.

The issue is not malware; it’s poor security practices baked directly into the app code.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

APPLE WARNS MILLIONS OF IPHONES ARE EXPOSED TO ATTACK

Cybernews researchers found that many iOS apps store sensitive secrets directly inside app files, where they can be easily extracted. (Kurt “CyberGuy” Knutsson)

What researchers discovered inside iOS apps

Security researchers at Cybernews, a cybersecurity research firm, analyzed the code of more than 156,000 iPhone apps. That represents about 8% of all apps available worldwide.

Here is what they found:

Over 815,000 hidden secrets inside app code
An average of five secrets per app
71% of apps leaked at least one secret

These secrets include passwords, API keys and access tokens. Developers place them directly inside apps, where anyone can extract them. According to Cybernews researcher Aras Nazarovas, this makes attackers’ jobs much easier than most users realize.

What are hardcoded secrets in simple terms?

A hardcoded secret is sensitive information saved directly inside an app instead of being protected on a secure server. Think of it like writing your bank PIN on the back of your debit card. Once someone downloads the app, they can inspect its files and pull out those secrets. Attackers do not need special access or advanced hacking tools. Both the Cybersecurity and Infrastructure Security Agency and the Federal Bureau of Investigation warn developers not to do this. Yet it is happening at a massive scale.

Cloud storage leaks exposed huge amounts of data

One of the most serious problems involves cloud storage. More than 78,000 iOS apps contained direct links to cloud storage buckets. These buckets store files such as photos, documents, receipts and backups. In some cases, no password was required at all. Researchers found:

836 storage buckets are fully open to the public
Over 76 billion exposed files
More than 406 terabytes of leaked data

This data included user uploads, registration details, app logs and private records. Anyone who knew where to look could view or download it.

APPLE PATCHES TWO ZERO-DAY FLAWS USED IN TARGETED ATTACKS

This chart shows the most common types of hardcoded secrets found inside iOS apps, with Google-related keys appearing most often, according to Cybernews research. (Cybernews)

Firebase databases were also left open

Many iOS apps rely on Google Firebase to store user data. Cybernews found more than 51,000 Firebase database links hidden in app code. While some were protected, over 2,200 had no authentication. That exposed:

Nearly 20 million user records
Messages, profiles, and activity logs
Databases that are mostly hosted in the U.S.

If a Firebase database is not locked down, attackers can browse user data like a public website.

Payment and login systems were at risk too

Some of the leaked secrets were far more dangerous than analytics or ads. Researchers discovered secret keys for:

Stripe, which handles payments and refunds
JWT authentication systems that control logins
Order management tools used by shopping apps

A leaked Stripe secret key can allow attackers to issue refunds, move money or access billing details. Leaked login keys can let attackers impersonate users or take over accounts.

AI and social apps were among the worst offenders

Some of the apps with the largest leaks were related to artificial intelligence. According to VX Underground, security firm CovertLabs identified 198 iOS apps leaking user data. The worst known case was Chat & Ask AI by Codeway. Researchers say it exposed chat histories, phone numbers and email addresses tied to millions of users. Another app, YPT – Study Group, reportedly leaked messages, user IDs and access tokens. CovertLabs tracks these incidents in a restricted repository called Firehound. The full list of affected apps has not been publicly released, and researchers say the data is limited to prevent further exposure and to give developers time to fix security flaws.

MALICIOUS GOOGLE CHROME EXTENSIONS HIJACK ACCOUNTS

This example shows how sensitive keys like Google API credentials and Stripe payment secrets can be stored directly inside an iOS app’s files, where they are easy to extract. (Cybernews)

Why Apple’s App review can miss hidden security risks

Apple reviews apps before they appear in the App Store. However, the review process does not scan app code for hidden secrets. If an app behaves normally during testing, it can pass review even if sensitive keys are buried inside its files. This creates a gap between Apple’s security claims and real-world risks. Removing leaked secrets is not simple for developers. They must revoke old keys, create new ones and rebuild parts of their apps. That can break features and delay updates. Even though Apple says most app updates are reviewed within 24 hours, some updates take weeks. During that time, vulnerable apps can remain available.

CyberGuy contacted Apple for comment, but did not receive a response before publication.

Ways to stay safe right now

You cannot easily inspect an app for hidden secrets. Apple does not provide tools for that. Still, you can reduce your risk and limit exposure by being selective and cautious. These steps help reduce the risk if an app leaks data behind the scenes.

1) Stick to established app developers

Well-known developers tend to have stronger security teams and better update practices. Smaller or unknown apps may rush features to market and overlook security basics. Before downloading, check how long the developer has been active and how often the app is updated.

2) Review and limit app permissions

Many apps ask for more access than they need. Location, contacts, photos and microphone access all increase the risk of data leaks. Go into your iPhone settings and remove permissions that are not essential for the app to work.

3) Delete apps you no longer use

Unused apps still retain access to data you shared in the past. They may also store information on remote servers long after you stop opening them. If you have not used an app in months, remove it. Here’s how: Open Settings, tap General, select iPhone Storage, and scroll through the list of apps to see when each one was last used. Tap any app you no longer need and select Delete App to remove it and reduce ongoing data exposure.

4) Be cautious with personal and financial details

Avoid entering sensitive information unless it is absolutely necessary. This includes full names, addresses, payment details and private conversations. AI apps are especially risky if you share deeply personal content.

5) Use a password manager for every account

A password manager creates strong, unique passwords for each app and service. This prevents attackers from accessing multiple accounts if one app leaks data. Never reuse passwords tied to your email address.

Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.

6) Change passwords tied to exposed apps

If an app uses your email address for login, change that password immediately. Do this even if there is no confirmation of a breach. Attackers often test leaked credentials across other services.

7) Consider using a data removal service

Some leaked data ends up with data brokers that sell personal information online. A data removal service can help find and remove your details from these databases. This reduces the chance that exposed app data gets reused for scams or identity theft.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

8) Monitor your accounts for unusual activity

Watch for unexpected emails, password reset notices, login alerts, or payment confirmations. These can signal that leaked data is already being abused. Act quickly if something looks off.

9) Pause use of risky AI and chat apps

If you use AI apps for private conversations, consider stopping until the developer confirms security fixes. Once data is exposed, it cannot be pulled back. Avoid sharing sensitive details with apps that store conversations remotely.

Kurt’s key takeaways

Apple’s App Store still offers important protections, but this research shows it is not foolproof. Many trusted iPhone apps quietly expose data due to basic security mistakes. Until app reviews improve, you need to stay alert and limit how much data you share.

How many apps on your iPhone have access to information you would not want exposed? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

Related Topics:apple Apps cybercrime Featured iphone Smartphones

Click to comment

Technology

Apple launches iOS 26.4 with AI playlists, purchase sharing, and more

Published

10 hours ago

March 24, 2026

Press Room

Apple launches iOS 26.4 with AI playlists, purchase sharing, and more

iOS 26.4 is here, and it comes with a bunch of small but notable updates. That includes a new Playlist Playground launching in beta in Apple Music, which uses AI to generate a song playlist — complete with a title, description, and tracklist — based on a text prompt.

Apple Music is also adding a new concert discovery feature, allowing you to find nearby shows featuring artists from your library, as well as new ones recommended by the app. Other updates include full-screen backgrounds for album and playlist pages, along with a new Offline Music Recognition tool that “identifies songs without an internet connection and delivers results automatically when you’re back online.”

Apple’s Family Sharing feature, which allows you to share Apple subscriptions with up to six other people, will now let each adult member add their own payment methods to make purchases (instead of just using the method belonging to the group organizer). Additionally, iOS 26.4 adds eight new emoji, including an orca, trombone, landslide, ballet dancer, and distorted face. It also improves the accuracy of its keyboard when typing quickly, according to Apple.

There are a few new accessibility features, too, including an update to Apple’s “reduce bright effects” setting that now minimizes flashes that occur when tapping on certain elements like buttons. Apple is making subtitle and caption settings easier to find as well, and says its “reduce motion” setting now “more reliably reduces the animations of Liquid Glass.”

Apple released its macOS 26.4 update as well, which introduces a new compact tab bar option in Safari and the ability to set charging limits from 80 to 100 percent to help preserve the lifespan of your device’s battery.

Technology

DocuSign email scam targets healthcare workers

Published

10 hours ago

March 24, 2026

Press Room

DocuSign email scam targets healthcare workers

Cyber expert shares tips to avoid AI phishing scams

Kurt ‘The CyberGuy’ Knutsson shares practical ways to avoid falling victim to AI-generated phishing scams and discusses a report that North Korean agents are posing as I.T. workers to funnel money into the country’s nuclear program.

NEWYou can now listen to Fox News articles!

Most of us sign documents online without thinking twice. A quick DocuSign request appears in your inbox. You click the link, review the document and move on with your day. That convenience is exactly what scammers rely on. Recently, we received a message from a CyberGuy reader that shows how convincing these scams can look. In this case, the email appeared to come from a health licensing authority and asked the recipient to review a document tied to a professional license renewal.

Here is the email we received from Susie, a registered nurse in Florida who nearly fell for the scam.

“I am a Registered Nurse, and my bi-annual renewal is approaching. Last month, I received a surprising (at least to me) email with a document to DocuSign from the state Board of Health. It didn’t feel right, even though I have used DocuSign multiple times in the past. Those experiences were known transactions. I contacted the state board, and they confirmed that it IS a SCAM. I sent them screenshots, etc. and reported the message for phishing. I want to thank you, Kurt, because it was thanks to you that I questioned the veracity of this outreach. Reading the articles and tips you provide saved me a great deal of trouble. Thanks again, and all you nurses out there renewing your license, be wary.” – Susie C, Orlando, FL

Susie did exactly what security experts recommend. She paused and verified the message before clicking anything. That one step likely prevented a phishing attack.

SCAMMERS ARE USING DOCUSIGN EMAILS TO PUSH APPLE PAY FRAUD

Security experts warn that DocuSign scams exploit routine online habits to steal passwords and access personal or professional accounts. (ilkercelik/Getty Images)

What the suspicious DocuSign email looked like

Susie also shared a screenshot of the message she received. At first glance, the email looks familiar. The blue layout resembles real DocuSign notifications. There is even a large yellow Review Document button. But one detail stood out immediately.

The email address sending the message was:
info.florida-department-of-health-email-notification@cc.ncu.edu.tw

That address has nothing to do with a U.S. state health department.

Why DocuSign scams work so well

DocuSign is used by millions of businesses and government agencies. Because people expect these requests, they often click without hesitation. Scammers exploit that habit. A typical DocuSign phishing email tries to create urgency. It may claim a license renewal, a contract update, or a payroll form requires immediate action. Once you click the button, several things may happen:

You may land on a fake login page designed to steal your email password.
The site may prompt you to download a malicious file.
The link may redirect you to several phishing pages.

In many cases, the goal is simple. Attackers want your email credentials so they can take over your account or launch more scams.

10 WAYS TO PROTECT SENIORS FROM EMAIL SCAMS

A Florida nurse avoided a DocuSign phishing scam after spotting a suspicious email tied to a fake health license renewal request. (Smith Collection/Gado/Getty Images)

Red flags in the DocuSign scam email

A few warning signs can help you spot a fake request quickly.

Suspicious sender address

Always look closely at the sender’s domain. Government agencies rarely send messages from foreign academic domains like .edu.tw. That alone signals something is wrong.

Unexpected documents

Legitimate DocuSign requests usually follow a known interaction. For example, a contract you discussed or paperwork you expect. An unexpected document should always raise questions.

Pressure to act quickly

Many phishing emails include language that urges immediate action. The goal is to stop you from thinking. Take a moment before clicking any button.

Generic document descriptions

The message shown in the screenshot simply states that a document is ready to review. It provides no real context or explanation. Legitimate documents often include details about the transaction.

How clicking the link could compromise you

Many people assume they will recognize a fake page. In reality, phishing sites look very convincing. Some scams even use cloned DocuSign pages. Once victims enter their credentials, attackers gain access to their email accounts.

From there, criminals can:

Reset passwords for financial services
Send phishing emails to contacts
Search inboxes for sensitive documents

In healthcare professions, that risk can also expose licensing information or patient-related communications.

APPLE APP PASSWORD SCAM EMAIL WARNING

Cybercriminals are using fake DocuSign emails to trick users into clicking malicious links and handing over sensitive login credentials. (Gabby Jones/Bloomberg via Getty Images)

Ways to stay safe from DocuSign phishing scams

Fortunately, a few habits can dramatically lower your risk.

1) Verify the request separately

If a document claims to come from a government agency or employer, contact them directly using a known phone number or website. Never use the contact information inside the suspicious email.

2) Hover over links before clicking

Move your cursor over the button and check the destination link. If the URL looks unfamiliar or unrelated to DocuSign, do not click it.

3) Don’t click links and use strong antivirus software

If an email seems suspicious, do not click the link or open any attachment. Strong antivirus software can help block malicious downloads, warn you about dangerous websites and catch threats before they spread across your device. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com

4) Use a data removal service

Scammers often gather personal details from data broker sites and public records to make phishing emails seem more believable. A data removal service can help reduce your exposed information online, which may make it harder for criminals to target you with convincing messages. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

5) Access documents through official accounts

If you regularly use DocuSign, sign in directly at the official website and check your pending documents there. That approach avoids email traps entirely.

6) Report phishing attempts

Forward suspicious messages to your organization’s security team or the Federal Trade Commission phishing reporting system at ReportFraud.ftc.gov. The FTC also advises forwarding phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org. Reporting scams helps protect others from the same attack.

Kurt’s key takeaways

Scams succeed because they blend into everyday routines. Signing documents online has become normal for work, healthcare licensing and financial paperwork. That convenience also gives criminals a perfect disguise. Susie’s story shows how a small moment of doubt can stop a phishing attack before it begins. A quick call to the licensing board revealed the truth. The message was never legitimate.

Now the question is one every reader should consider. If a DocuSign email arrived in your inbox right now, would you notice the warning signs before clicking the button? Let us know by writing to us at Cyberguy.com

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Technology

The US government just banned consumer routers made outside the US

Published

22 hours ago

March 24, 2026

Press Room

The US government just banned consumer routers made outside the US

In December, the Federal Communications Commission banned all future drones made in foreign countries from being imported into the United States, unless or until their maker gets an exemption. Now, the FCC has done the exact same for consumer networking gear, citing “an unacceptable risk to the national security of the United States and to the safety and security of U.S. persons.”

If you already have a Wi-Fi or wired router, you can keep on using it — and companies that have already gotten FCC radio authorization for a specific foreign-made product can continue to import that product.

But since the vast majority — if not all — consumer routers are manufactured outside the United States, the vast majority of future consumer routers are now banned. By adding all foreign-made consumer routers to its Covered List, the FCC is saying it will no longer authorize their radios, which de facto bans new devices from import into the country.

Now, router makers need to A) secure a “conditional approval” that lets them keep getting new products cleared for US entry while they work to convince the government that they’ll open up manufacturing in the US, or B) make the decision to skip selling future products in the US, like dronemaker DJI already did.

Like with the foreign drone ban, the FCC has a National Security Determination that it says justifies these actions, one which claims that “Allowing routers produced abroad to dominate the U.S. market creates unacceptable economic, national security, and cybersecurity risks,” and that “routers produced abroad were directly implicated in the Volt, Flax, and Salt Typhoon cyberattacks which targeted critical American communications, energy, transportation, and water infrastructure.”

“Given the criticality of routers to the successful functioning of our nation’s economy and defense, the United States can no longer depend on foreign nations for router manufacturing,” reads another passage.

It is true that a great many router vulnerabilities have surfaced over the years, which make them a popular target for hackers and botnets. It is also true that one China-founded company, TP-Link, is dominant in the US consumer market; US authorities had previously considered a specific TP-Link ban due to that dominance and national security concerns. (TP-Link has been attempting to distance itself from China, splitting off from the Chinese entity in 2022, establishing a global headquarters in California in 2024, and suing Netgear in 2025 for suggesting that TP-Link had been infiltrated by the Chinese government.)

It is not clear how simply moving production of routers domestically would make them safer. In the Volt Typhoon hack, Chinese state-sponsored hackers primarily targeted Cisco and Netgear routers, routers designed by US companies, according to the Department of Justice. They were vulnerable because those US companies had stopped providing security updates to the specific targeted routers, which had been discontinued by those companies.

While the FCC’s Covered List makes it sound like the US is banning all “routers produced in a foreign country,” it’s defined a bit more narrowly than that. It’s specifically banning “consumer-grade routers” as defined in NIST Internal Report 8425A, which refers to ones “intended for residential use and can be installed by the customer.”

“Virtually all routers are made outside the United States, including those produced by U.S.-based companies like TP-Link, which manufactures its products in Vietnam,” reads part of a statement from TP-Link via third-party spokesperson Ricca Silverio. “It appears that the entire router industry will be impacted by the FCC’s announcement concerning new devices not previously authorized by the FCC.”

Update, March 23rd: Clarified how TP-Link has distanced itself from China, and added company statement.

Follow topics and authors from this story to see more like this in your personalized homepage feed and to receive email updates.