Hackers Exploit SS7 and Diameter Flaws to Track Mobile Users Globally

Gbhackers •Divya • April 24, 2026

A recent investigation by Citizen Lab has uncovered sophisticated, multi-year surveillance campaigns exploiting foundational vulnerabilities in global mobile networks. The report, titled “Bad Connection,” reveals how suspected commercial surveillance vendors (CSVs) weaponize the SS7 and Diameter signaling protocols to covertly track high-profile individuals across the globe without interacting directly with their devices. These findings underscore […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Global Telecom Exploitation: Covert Surveillance Campaigns Uncovered Recent investigations by Citizen Lab revealed two sophisticated surveillance campaigns exploiting vulnerabilities in global mobile networks, particularly through the SS7 and Diameter signaling protocols. These campaigns, attributed to unidentified commercial surveillance vendors, have been tracking individuals' locations without direct device interaction. The research indicates that the campaigns utilized access to three telecom providers: 019Mobile (Israel), Tango Networks (UK), and Airtel Jersey (Channel Islands). Despite the implementation of newer security features in Diameter, attackers have found ways to exploit both Diameter and the older SS7 protocol. The findings highlight a systemic issue where telecom infrastructure, designed for seamless connectivity, is misused for covert surveillance. This ongoing exploitation raises significant concerns for regulators and the telecom industry regarding accountability and oversight. The report emphasizes that despite previous disclosures, such activities persist without repercussions. 9 sources 65

Extracted Entities

Platforms (2)

Diameter SS7