Technology

Thousands of iPhone apps expose data inside Apple App Store

Published

4 days ago

January 30, 2026

Thousands of iPhone apps expose data inside Apple App Store

NEWYou can now listen to Fox News articles!

Apple often promotes the App Store as a secure place to download apps. The company highlights strict reviews and a closed system as key protections for iPhone users. That reputation now faces serious questions.

New research shows that thousands of iOS apps approved by Apple contain hidden security flaws. These flaws can expose user data, cloud storage and even payment systems.

The issue is not malware; it’s poor security practices baked directly into the app code.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

APPLE WARNS MILLIONS OF IPHONES ARE EXPOSED TO ATTACK

Cybernews researchers found that many iOS apps store sensitive secrets directly inside app files, where they can be easily extracted. (Kurt “CyberGuy” Knutsson)

What researchers discovered inside iOS apps

Security researchers at Cybernews, a cybersecurity research firm, analyzed the code of more than 156,000 iPhone apps. That represents about 8% of all apps available worldwide.

Here is what they found:

Over 815,000 hidden secrets inside app code
An average of five secrets per app
71% of apps leaked at least one secret

These secrets include passwords, API keys and access tokens. Developers place them directly inside apps, where anyone can extract them. According to Cybernews researcher Aras Nazarovas, this makes attackers’ jobs much easier than most users realize.

What are hardcoded secrets in simple terms?

A hardcoded secret is sensitive information saved directly inside an app instead of being protected on a secure server. Think of it like writing your bank PIN on the back of your debit card. Once someone downloads the app, they can inspect its files and pull out those secrets. Attackers do not need special access or advanced hacking tools. Both the Cybersecurity and Infrastructure Security Agency and the Federal Bureau of Investigation warn developers not to do this. Yet it is happening at a massive scale.

Cloud storage leaks exposed huge amounts of data

One of the most serious problems involves cloud storage. More than 78,000 iOS apps contained direct links to cloud storage buckets. These buckets store files such as photos, documents, receipts and backups. In some cases, no password was required at all. Researchers found:

836 storage buckets are fully open to the public
Over 76 billion exposed files
More than 406 terabytes of leaked data

This data included user uploads, registration details, app logs and private records. Anyone who knew where to look could view or download it.

APPLE PATCHES TWO ZERO-DAY FLAWS USED IN TARGETED ATTACKS

This chart shows the most common types of hardcoded secrets found inside iOS apps, with Google-related keys appearing most often, according to Cybernews research. (Cybernews)

Firebase databases were also left open

Many iOS apps rely on Google Firebase to store user data. Cybernews found more than 51,000 Firebase database links hidden in app code. While some were protected, over 2,200 had no authentication. That exposed:

Nearly 20 million user records
Messages, profiles, and activity logs
Databases that are mostly hosted in the U.S.

If a Firebase database is not locked down, attackers can browse user data like a public website.

Payment and login systems were at risk too

Some of the leaked secrets were far more dangerous than analytics or ads. Researchers discovered secret keys for:

Stripe, which handles payments and refunds
JWT authentication systems that control logins
Order management tools used by shopping apps

A leaked Stripe secret key can allow attackers to issue refunds, move money or access billing details. Leaked login keys can let attackers impersonate users or take over accounts.

AI and social apps were among the worst offenders

Some of the apps with the largest leaks were related to artificial intelligence. According to VX Underground, security firm CovertLabs identified 198 iOS apps leaking user data. The worst known case was Chat & Ask AI by Codeway. Researchers say it exposed chat histories, phone numbers and email addresses tied to millions of users. Another app, YPT – Study Group, reportedly leaked messages, user IDs and access tokens. CovertLabs tracks these incidents in a restricted repository called Firehound. The full list of affected apps has not been publicly released, and researchers say the data is limited to prevent further exposure and to give developers time to fix security flaws.

MALICIOUS GOOGLE CHROME EXTENSIONS HIJACK ACCOUNTS

This example shows how sensitive keys like Google API credentials and Stripe payment secrets can be stored directly inside an iOS app’s files, where they are easy to extract. (Cybernews)

Why Apple’s App review can miss hidden security risks

Apple reviews apps before they appear in the App Store. However, the review process does not scan app code for hidden secrets. If an app behaves normally during testing, it can pass review even if sensitive keys are buried inside its files. This creates a gap between Apple’s security claims and real-world risks. Removing leaked secrets is not simple for developers. They must revoke old keys, create new ones and rebuild parts of their apps. That can break features and delay updates. Even though Apple says most app updates are reviewed within 24 hours, some updates take weeks. During that time, vulnerable apps can remain available.

CyberGuy contacted Apple for comment, but did not receive a response before publication.

Ways to stay safe right now

You cannot easily inspect an app for hidden secrets. Apple does not provide tools for that. Still, you can reduce your risk and limit exposure by being selective and cautious. These steps help reduce the risk if an app leaks data behind the scenes.

1) Stick to established app developers

Well-known developers tend to have stronger security teams and better update practices. Smaller or unknown apps may rush features to market and overlook security basics. Before downloading, check how long the developer has been active and how often the app is updated.

2) Review and limit app permissions

Many apps ask for more access than they need. Location, contacts, photos and microphone access all increase the risk of data leaks. Go into your iPhone settings and remove permissions that are not essential for the app to work.

3) Delete apps you no longer use

Unused apps still retain access to data you shared in the past. They may also store information on remote servers long after you stop opening them. If you have not used an app in months, remove it. Here’s how: Open Settings, tap General, select iPhone Storage, and scroll through the list of apps to see when each one was last used. Tap any app you no longer need and select Delete App to remove it and reduce ongoing data exposure.

4) Be cautious with personal and financial details

Avoid entering sensitive information unless it is absolutely necessary. This includes full names, addresses, payment details and private conversations. AI apps are especially risky if you share deeply personal content.

5) Use a password manager for every account

A password manager creates strong, unique passwords for each app and service. This prevents attackers from accessing multiple accounts if one app leaks data. Never reuse passwords tied to your email address.

Next, see if your email has been exposed in past breaches. Our No. 1 password manager pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials.

Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.

6) Change passwords tied to exposed apps

If an app uses your email address for login, change that password immediately. Do this even if there is no confirmation of a breach. Attackers often test leaked credentials across other services.

7) Consider using a data removal service

Some leaked data ends up with data brokers that sell personal information online. A data removal service can help find and remove your details from these databases. This reduces the chance that exposed app data gets reused for scams or identity theft.

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

8) Monitor your accounts for unusual activity

Watch for unexpected emails, password reset notices, login alerts, or payment confirmations. These can signal that leaked data is already being abused. Act quickly if something looks off.

9) Pause use of risky AI and chat apps

If you use AI apps for private conversations, consider stopping until the developer confirms security fixes. Once data is exposed, it cannot be pulled back. Avoid sharing sensitive details with apps that store conversations remotely.

Kurt’s key takeaways

Apple’s App Store still offers important protections, but this research shows it is not foolproof. Many trusted iPhone apps quietly expose data due to basic security mistakes. Until app reviews improve, you need to stay alert and limit how much data you share.

How many apps on your iPhone have access to information you would not want exposed? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

Related Topics:apple Apps cybercrime Featured iphone Smartphones

Click to comment

Technology

The Switch is now Nintendo’s best-selling console of all time

Published

8 hours ago

February 3, 2026

Press Room

The Switch is now Nintendo’s best-selling console of all time

The original Switch is officially Nintendo’s best-selling console of all time after surpassing the DS handheld in lifetime sales. In its latest earnings release, Nintendo reports that the Nintendo Switch has, as of December 31, 2025, sold 155.37 million units since its launch in 2017, compared to 154.02 million units for the 2004 Nintendo DS.

In November, Nintendo reported that the Switch and DS were neck and neck. We expected the holiday sales period would see the Switch surpass the DS, even with Nintendo announcing that primary development would focus on the Switch 2. Nintendo previously said that it would continue to sell the original Switch “while taking consumer demand and the business environment into consideration.”

Nintendo has to keep selling the Switch if it wants to dethrone Sony’s PlayStation 2 as the best-selling video game console of all time. The PlayStation 2, discontinued in January 2013, sold more than 160 million units over its 13-year lifespan.

Demand for the Switch 2 accelerated over the holidays, with Nintendo reporting 7.01 million units sold during the quarter covering October through December, compared to 4.54 million units in the previous quarter. In total, the Switch 2 has now sold 17.37 million units since it launched in June 2025, taking less than a year to surpass the Wii U’s 13.7 million lifetime sales.

The Switch 2 launch has helped Nintendo to drive a 51 percent increase in net profit over the first nine months of FY26, reaching ¥358.86 billion (about $2.31 billion). Net sales almost doubled during the same period, jumping to ¥1.906 trillion (about $12.2 billion) compared to ¥956.2 billion ($6.1 billion) last year. Looking ahead, Nintendo maintains its forecast to sell 19 million Switch 2 units by the end of this financial year.

Technology

Artificial Intelligence helps fuel new energy sources

Published

9 hours ago

February 3, 2026

Press Room

Artificial Intelligence helps fuel new energy sources

NEWYou can now listen to Fox News articles!

Artificial Intelligence and data centers have been blamed for rising electricity costs across the U.S. In December 2025, American consumers paid 42% more to power their homes than ten years ago.

“When you have increased demand and inadequate supply, costs are going to go up. And that’s what we’re experiencing right now,” Exelon CEO Calvin Butler said.

TRUMP SAYS EVERY AI PLANT BEING BUILT IN US WILL BE SELF-SUSTAINING WITH THEIR OWN ELECTRICITY

In 2024, U.S. data centers used more than 4% of total U.S. electricity consumption according to the International Energy Agency. That equates to as much electricity as the entire nation of Pakistan uses annually. U.S. Data Center consumption is expected to grow by 133% by the end of the decade, using as much power as the entire country of France.

“We’re headquartered in Chicago, and we’re the owner of ComEd, the fourth-largest utility in the nation. ComEd’s peak load is roughly 23 gigawatts. We have had data center load come onto the system, but by 2030, we’ll be at 19 Gigawatts,” Butler said.

Artifical intelligence data centers in the U.S. used more than 4% of the total U.S. electricity consumption, according to the International Energy Agency. (Exelon)

Commonwealth Edison has experienced a dramatic increase in data center connection requests. The potential projects total more than 30 gigawatts and are expected to come online between now an 2045.

“Our growth is unprecedented in the last several decades. So, with the data center advent and the technology coming, we’ve been forced to serve that load, which is our responsibility,” Butler said. “But what we also have to do is build new generation supply, which is not keeping up with the load that is coming on. And that’s the crunch that we’re in right now.”

IN 2026, ENERGY WAR’S NEW FRONT IS AI, AND US MUST WIN THAT BATTLE, API CHIEF SAYS

Commonwealth Edison is asking regulators for a $15.3 billion 4-year grid update to meet the growing demand. The U.S. overall has increased its grid capacity by more than 15% over the last decade, but many utility companies and energy producers say it is not enough.

“We’re at a stage right now where we’re constrained by electricity,” Commonwealth Fusion Systems CEO Bob Mumgaard said. “You want to make power plants that can make a lot of power in a small package that you can put anywhere, that you could run at any time and fusion fits that bill.”

Zanskar, is the first AI-native geothermal energy company, according to their website. This plant is located in New Mexico. (Zanskar)

Commonwealth Fusion Systems is working to add a new form of nuclear energy to the grid — fusion. It has the same reliable benefits of standard nuclear energy already in use, but does not produce long-lived radioactive waste and carries fewer risks.

“In fusion there’s no chain reaction. The result is helium which is safe and inert and you don’t use it to make anything related to weapons,” Mumgaard said.

US POWER CRUNCH LOOMS AS OKLO CEO SAYS GRID CAN’T KEEP UP WITHOUT NEW INVESTMENT

Commonwealth Fusion Systems says Artificial Intelligence is helping bring fusion energy closer to being a new resource.

“Building and designing these complex machines and manipulating this complex data matter of plasma are all things that we’re still learning and we’re still figuring out how to do,” Mumgaard said. “And that’s an area where we’ve been able to accelerate using A.I.”

Other under-utilized energy sources could soon get a big boost thanks to A.I. Geothermal energy is a small part of the electric grid, because of the high drilling costs and low confidence in where to place infrastructure.

Geothermal and nuclear fusion technology will allow energy to be produced in any weather at any time. (AP)

“If you could drill the perfect geothermal well every single time, like you pick the right spot, you design the right well, you drill the 5,000, 8,000 feet, you hit 400F degree temperatures, that’s incredibly productive,” Zanskar Co-founder Joel Edwards said. “If you could do that every single time over and over and again, geothermal power is the cheapest source of power period.”

Zanskar is working to make the geothermal search more exact. The company uses A.I.-fueled mapping to find untapped resources previously thought non-existent.

“If we could just get more precise in where we go to find the things and then how we drill into the things, geothermal absolutely has the cost curve to come down,” Edwards said. “And that’s sort of what we’re running towards, with A.I. sort of giving us the boost, giving us an edge to do that.”

Both geothermal and nuclear fusion can produce energy in any weather at any time, a component that could have helped ease the grid strain amid the recent winter storm.

“It’s critical, and we’ve been raising that alarm for years now, and I use the analogy that you’re driving a car and your check engine light is on, but you keep driving it, hoping that you’ll keep getting there and keep going, but when it breaks down, you’re going to have a significantly higher cost,” Butler said. “We have to pay attention to what’s going on, and this winter storm – Winter Storm Fern – is indicative of what’s coming.”

Bret Baier currently serves as FOX News Channel’s (FNC) anchor and executive editor of Special Report with Bret Baier (weeknights at 6-7PM/ET), chief political anchor of the network and co-anchor of the network’s election coverage. Baier is also host of FOX News Audio’s “The Bret Baier Podcast” which includes Common Ground and The All-Star Panel. He joined FNC in 1998 as the first reporter in the Atlanta bureau and is now based in Washington, D.C. where he was recently described as “the most influential news anchor in America right now” at the 2025 Semafor Trust in News summit.

Technology

Waymo raises $16 billion to take its robotaxi business ‘global’

Published

20 hours ago

February 2, 2026

Press Room

Waymo raises billion to take its robotaxi business ‘global’

Waymo announced a $16 billion investment round aimed at bringing its robotaxi business to more US cities, as well as some overseas markets. The funding round was led by Dragoneer Investment Group, a “crossover” firm known for investing in late-stage tech companies before they go public.

Waymo’s co-CEOs said in a blog post they would use some of the money to buy more vehicles to grow its fleets size, a crucial step as it seeks to launch in at least 20 new cities in 2026. The company currently operates more than 2,500 robotaxis in six US cities. The new funding values Waymo at $126 billion.

Waymo’s latest funding round attracted several new investors, including Dragoneer, Sequoia Capital, and DST Global. Returning investors include Andreessen Horowitz, Abu Dhabi sovereign fund Mubadala, Fidelity Management and Research Company, Perry Creek Capital, Silver Lake, Tiger Global, Temasek, and T. Rowe Price. The company last raised a $5.6 billion in 2024, valuing the company at $45 billion.

Despite their promise to bring down costs by eliminating driver jobs, autonomous ridehail vehicles are enormously expensive. In addition to vehicle purchases, companies must install expensive sensors and computers into each vehicle. The robotaxis need to be monitored by remote operators during trips. And fleet managers handle EV charging, cleaning, and sensor calibration while the robotaxis are offline.

Still, Waymo is one of the few companies to run a paid service with fully driverless vehicles in the US. Amazon’s Zoox is still running free trips in a handful of cities, while Tesla has yet to transition away from using safety monitors in the vehicle.