AirTag and SmartTag: How to Detect If a Bluetooth Tracker Is Following You
Phones can now warn users when an unknown Bluetooth tracker such as an Apple AirTag or Samsung SmartTag is moving alongside them for an extended period. The alerts do not automatically confirm stalking, since the same tags can be left in taxis, rental cars or borrowed bags, yet they should never be ignored.
AirTag and SmartTag are small Bluetooth devices roughly the size of a large coin. Owners attach them to keys, bags, luggage, bicycles or pet collars so the items can be located on a map through the phone app. The tags themselves contain no GPS chip, SIM card or microphone; they simply broadcast a short Bluetooth signal that nearby phones anonymously forward to the owner.
Apple’s network is called Find My and draws on millions of iPhones, while Samsung uses SmartThings Find and Galaxy devices. Google operates a similar Android Find Hub network. The more phones nearby, the more accurate and frequent the location updates become.
What the notification actually means
An iPhone running iOS 17.5 or later may display a message that an AirTag or compatible tracker is traveling with the user. Android devices show a comparable alert about an unknown tracker that has been moving together with the phone owner. The warning triggers only when the tag is separated from its registered owner and stays near the user for a prolonged time.
Users should become concerned if the same unknown tag appears repeatedly, follows them after meetings or trips, or triggers alerts near home or in locations where strangers should not have access.
Immediate steps after receiving an alert
- Take screenshots of the notification, map and timestamps before dismissing anything.
- Do not turn off Bluetooth, as it is required to locate the device.
- Move to a public area, contact a trusted person or call emergency services if the situation feels threatening.
- Search bags, clothing, strollers and recently received items.
How to locate the tracker
On iPhone, open the alert card to view the route, play a sound on the tag or scan nearby. The serial number can be read via NFC by bringing the tag close to the phone. On Android 6.0 and newer, search settings for “unknown trackers” or use the open-source AirGuard app for additional scanning of Apple and Find My networks.
Start the physical search with items that stay close to the body: bags, coats, wallets, laptop cases and car interiors including door pockets, under seats and floor mats. Never attempt to disassemble wiring or crawl under a vehicle; instead contact police or a service center.
Evidence and police involvement
Photograph the tag in place, preserve all notifications and route data, and record the serial number if displayed. Do not discard or hand the device to a suspected owner. File a police report when a tag is found inside personal property without explanation or when accompanied by threats or stalking behavior. In life-threatening situations call 112.
Reducing future risk
- Keep iOS, Android, Google services and SmartThings updated.
- Review location-sharing permissions in Find My, Google Maps and messaging apps.
- Remove unknown devices from Apple ID, Google and Samsung accounts.
- Enable two-factor authentication and change passwords after relationship changes or device loss.
Related articles
VPN Encryption Alone Cannot Hide Traffic from Network Detection Systems
A Habr user known as mr_tom detailed why encrypted VPN connections remain detectable despite their encryption. Observers can identify connections through visible metadata such as server IP addresses, ports, transport protocols, handshake patterns, packet sizes, timing intervals, and overall flow behavior. Simple DPI systems block traffic by restricting known IPs or ports, while advanced filters build traffic fingerprints and use active probing to verify suspicious endpoints. The popular combination of VLESS, XHTTP, and REALITY operates across different layers rather than functioning as three equivalent VPN protocols. Even traffic on port 443 can be distinguished from standard HTTPS by analyzing handshake details and subsequent packet behavior. The core conclusion is that no universally unblockable VPN exists, as detection can rely on IP blocking, new signatures, or active verification regardless of encryption strength.
Browser Extension Anonymizes Sensitive Data Before Sending to AI Chatbots
A new browser extension automatically detects and replaces sensitive information such as names, INN numbers, bank cards, and emails with pseudonyms before any text or files reach AI chat services. The tool operates entirely locally in the browser, ensuring original data never leaves the user's device while allowing AI models to process anonymized placeholders. Responses from the AI are decrypted back to readable form only on the user's screen using an in-memory mapping that disappears when the browser closes. The solution supports over 70 file formats including DOCX, XLSX, and PDF, plus offline OCR for scanned documents to handle the most common leakage vectors used by HR, legal, and accounting teams. Multiple validation layers including checksums, Luhn algorithm, entropy checks, and normalization for Russian name declensions reduce false positives that plagued earlier regex-based attempts. The extension is available in a free version on the Chrome Web Store covering 33 data categories, with advanced file and scan features offered on request.
Browser Privacy Ranking 2026: Tor Browser Leads at 9.5 While Chrome and Yandex Rank Lowest
SecurityLab.ru has published a detailed 2026 browser privacy ranking that evaluates major browsers across six criteria including initial network behavior, site isolation, fingerprint resistance, funding model, configurability, and code auditability. Tor Browser scores highest at 9.5 for its comprehensive protections including unified fingerprinting and layered JavaScript controls, followed by Mullvad Browser at 9.0 and LibreWolf at 8.5. Brave earns 7.5 for built-in tracker blocking but faces criticism over default telemetry and cryptocurrency features. Firefox scores 6.0 out of the box yet reaches 8.5 after extensive configuration, while Google Chrome, Microsoft Edge, Opera, and Yandex Browser occupy the bottom positions due to persistent tracking mechanisms and closed-source components. The report also highlights the Local Mess localhost tracking technique used by Meta and Yandex that bypassed browser isolation entirely.
Russian Ministry Certificates Enable Potential State MITM on Foreign Domains
Russian companies facing sanctions have started adopting root certificates issued by the Ministry of Digital Development and Communications to maintain HTTPS access after commercial CAs revoked or refused to renew their certificates. Installing these Ministry certificates allows browsers to trust sites using Russian national CAs but also creates a pathway for man-in-the-middle interception by state-controlled entities. The article details a concrete threat model where a government-linked operator could use the Ministry root to generate on-the-fly certificates for any domain, including foreign services outside Russian jurisdiction. To mitigate this, the author demonstrates how to re-sign the Ministry root with OpenSSL nameConstraints limited to .ru, .su, and .рф domains only. Tests on macOS with Homebrew show that the constrained certificate still validates Russian banking sites such as online.sberbank.ru while correctly rejecting attempts to validate foreign domains like sberbank.com. The technique requires users to maintain their own cross-signed root and never rely on pre-installed Ministry or Yandex Browser roots for full protection.