In a recent cybersecurity advisory, the FBI warns iPhone Android users about escalating security threats targeting mobile devices. This comprehensive guide examines the latest FBI warnings and provides practical, actionable steps to secure your smartphone against increasingly sophisticated attacks. Let’s break down exactly what you need to know to keep your device safe.
Recent Cyberattacks Targeting Mobile Users
The landscape of mobile security threats has evolved dramatically in recent years, with both casual criminals and state-sponsored actors developing increasingly sophisticated methods to compromise smartphones.
According to FBI cybersecurity experts, attacks targeting mobile devices increased by 42% in the past year alone, with both iOS and Android systems facing unique vulnerabilities:
- iOS vulnerabilities: Exploitation of zero-day flaws in WebKit browser engines
- Android vulnerabilities: Malicious apps bypassing Google Play Protect verification
- Cross-platform threats: Network-level interception affecting all devices
Overview of Chinese Cyberattacks on U.S. Telecommunications
The FBI warns iPhone Android users specifically about Chinese state-sponsored hacking groups targeting U.S. telecommunications infrastructure. These advanced persistent threat (APT) groups have demonstrated alarming capabilities:
“We’ve observed a significant increase in sophisticated attacks originating from China-based threat actors targeting mobile communication platforms,” noted the FBI’s Cyber Division in their latest security bulletin. These operations often begin with supply chain compromises or zero-day exploits that can affect devices regardless of user behavior.
Recent investigations revealed that several telecommunications providers experienced breaches that potentially exposed:
- Call records and text message content
- Precise location data histories
- Authentication tokens and session data
- Contact information and device identifiers
For additional information on these threats, the FBI’s Internet Crime Complaint Center provides regular updates on emerging attack patterns.
The Role of Salt Typhoon in Network Vulnerabilities
One particularly concerning threat actor identified by the FBI is “Salt Typhoon,” a sophisticated hacking group believed to be operating with the support of Chinese intelligence services. Salt Typhoon has developed custom malware capable of exploiting vulnerabilities in cellular network protocols.
The FBI’s technical analysis indicates that Salt Typhoon operations have successfully exploited SS7 protocol vulnerabilities, allowing them to:
- Intercept SMS verification codes sent to mobile devices
- Track device locations with precision down to individual cell towers
- Redirect calls and messages without user knowledge
- Potentially bypass two-factor authentication systems relying on SMS
These capabilities represent a significant threat to privacy and security, as they can circumvent many traditional security measures. The FBI has shared technical indicators of compromise with major telecommunications providers, which you can review at CISA’s Advisory Database.
Recommended Practices for Secure Communication
In light of these threats, the FBI warns iPhone Android users to adopt specific recommendations for securing mobile communications, with a particular emphasis on end-to-end encryption and careful app selection.
Importance of Encrypted Messaging Apps
The FBI strongly recommends using end-to-end encrypted messaging applications for all sensitive communications. Unlike standard text messages, properly encrypted messaging prevents anyone—including service providers, hackers, or government agencies—from accessing message content.
“End-to-end encryption remains one of the most effective defenses against communication interception,” states the FBI advisory. “We recommend using reputable encrypted messaging platforms for any sensitive personal or business communications.”
How to verify if your messaging app is truly secure:
- Check if encryption is enabled by default (not optional)
- Verify the app uses open-source code that has undergone independent security audits
- Confirm it offers self-destructing message capabilities
- Research the app’s metadata collection and retention policies
- Ensure it provides local encryption of message databases
Avoiding Text Messaging Between iPhone and Android Users
In a particularly notable recommendation, the FBI warns iPhone Android users against using standard SMS text messaging, especially for communications between iPhone and Android devices.
Why cross-platform texting is vulnerable:
- iPhone-to-iPhone messages use Apple’s encrypted iMessage service
- Android-to-Android messages increasingly use Google’s RCS protocol
- However: iPhone-to-Android messages default to unencrypted SMS
“Standard text messages sent between different operating systems represent a significant security vulnerability,” the FBI warning states. “These messages are transmitted in plaintext and can be intercepted at multiple points in the transmission process.”
The vulnerability is especially pronounced when:
- Messages contain sensitive personal information
- Communications include verification codes or passwords
- Users are connected to public Wi-Fi or potentially compromised networks
Step-by-step guide to secure your text messages:
- Identify contacts you communicate with across platforms (iPhone to Android)
- Choose a secure third-party messaging platform (see recommendations below)
- Install the same app on both devices
- Verify encryption is active (look for security indicators in the app)
- Move sensitive conversations to this platform
Secure Messaging Alternatives: WhatsApp, Signal, Telegram
The FBI has identified several messaging platforms that provide adequate security for most users. Based on technical analysis and security features, the following platforms offer significant improvements over standard texting:
Signal: Widely regarded as the gold standard for secure messaging, Signal provides end-to-end encryption, minimal metadata collection, and is fully open-source. The FBI notes that Signal’s protocol is “technically sound” and has undergone extensive security audits.
Setting up Signal securely:
- Download from official app stores only
- Verify your phone number
- Enable registration lock for added security
- Set up a PIN code for local access
- Enable disappearing messages for sensitive conversations
WhatsApp: Despite being owned by Meta, WhatsApp implements the Signal protocol for message encryption and provides end-to-end encryption by default. The FBI notes that WhatsApp remains “substantially more secure than standard text messaging,” though they caution about its metadata collection practices.
Enhancing WhatsApp security:
- Disable cloud backups or enable encrypted backups
- Enable two-factor authentication
- Manage privacy settings to limit profile visibility
- Regularly check linked devices
- Use the lock feature for additional local security
Telegram: While offering encrypted “secret chats,” the FBI notes that Telegram’s standard chats are not end-to-end encrypted by default. They recommend enabling secret chats and setting self-destruct timers when using this platform.
Using Telegram securely:
- Always use “Secret Chats” for sensitive communication
- Enable 2FA with a strong password
- Review and restrict privacy settings
- Set up auto-delete timers for messages
- Verify security keys for important contacts
Identifying and Avoiding Scams
Beyond infrastructure vulnerabilities, the FBI warns iPhone Android users about the growing sophistication of social engineering attacks targeting smartphone users, which have become increasingly difficult to detect.
Common Scams Targeting Smartphone Users
The FBI has documented a sharp rise in mobile-specific scams, many leveraging stolen personal information from previous data breaches to appear legitimate. The most prevalent threats include:
Smishing (SMS Phishing): Text messages that appear to come from trusted entities like banks, delivery services, or government agencies. These messages typically contain malicious links that harvest credentials or install malware.
How to identify smishing attempts:
- Check for generic greetings rather than your name
- Look for urgency or threatening language
- Examine the sender’s number for irregular patterns
- Hover over links (don’t click) to see actual URL destinations
- Verify independently through official websites or phone numbers
One-Ring Scams: Scammers call and hang up after one ring, hoping victims will call back. These return calls often connect to premium international numbers that charge excessive fees.
Protecting yourself from one-ring scams:
- Research unfamiliar area codes before calling back
- Be suspicious of calls from these international codes: +809, +284, +649, +876
- Use reverse phone lookup services to verify unknown numbers
- Contact your carrier about blocking international calls if you don’t need them
- Report suspicious numbers to the FCC Consumer Complaint Center
Application Fraud: Legitimate-looking apps on official stores that actually contain malicious code designed to steal data or generate fraudulent charges. The FBI notes that over 1,800 malicious apps were identified in official app stores last year alone.
Signs of Romance Scams in Online Communications
The FBI warns iPhone Android users about romance scams, which have caused over $1 billion in reported losses last year. These sophisticated social engineering attacks often begin on dating apps before moving to messaging platforms.
Warning signs identified by the FBI include:
- Requests to move from dating platforms to messaging apps unusually quickly
- Reluctance or technical “issues” preventing video calls
- Elaborate stories explaining why in-person meetings aren’t possible
- Discussions of investments, cryptocurrency, or financial opportunities
- Requests for financial assistance for emergencies or travel plans
- Perfect, model-like photos that may appear slightly artificial
“Romance scammers have become extraordinarily sophisticated,” the FBI warns. “They often research victims extensively using social media profiles and tailor their approaches accordingly.”
How to verify a potential romance scammer:
- Perform reverse image searches on profile pictures
- Request video calls and note resistance or excuses
- Research specific details they share about their life
- Be wary of early expressions of intense feelings
- Report suspicious profiles to both the platform and the FBI’s IC3
Warning Signs of Phishing Messages
The FBI has outlined specific indicators that a message may be part of a phishing attempt:
- Urgent requests for personal information or immediate action
- Subtle misspellings in sender domains (like amaz0n.com instead of amazon.com)
- Links that don’t match the purported sender when examined closely
- Unexpected attachments, especially executable files or documents requesting macros
- Messages about accounts you don’t have or purchases you didn’t make
- Poor grammar or unusual phrasing that might indicate foreign origin
- Offers that seem too good to be true or threaten negative consequences
“Taking a moment to verify the legitimacy of communications before responding can prevent the majority of successful phishing attempts,” the FBI advisory notes.
To report phishing attempts, use the CISA Phishing Campaign Reporting Form.
Protecting Personal Information
Beyond securing communications, the FBI warns iPhone Android users about the importance of fundamental security practices to protect personal information stored on mobile devices.
Importance of Regular Software Updates
The FBI strongly urges all mobile users to install operating system and app updates promptly. Security patches address known vulnerabilities that hackers actively exploit, often within hours of their public disclosure.
“Delaying updates creates an unnecessary security risk,” the FBI warns. “Many major mobile compromises we investigate exploit vulnerabilities that had already been patched in available updates.”
Step-by-step guide to ensuring your device stays updated:
For iPhone users:
- Go to Settings > General > Software Update
- Enable “Automatic Updates”
- Ensure both “Download iOS Updates” and “Install iOS Updates” are toggled on
- Connect to Wi-Fi and power regularly to allow updates to install overnight
For Android users:
- Go to Settings > System > System update (may vary by manufacturer)
- Check for available updates
- Enable “Auto download over Wi-Fi” if available
- Also update apps through Google Play Store > Profile > Manage apps & device
Utilizing Multi-Factor Authentication for Enhanced Security
The FBI warns iPhone Android users that multi-factor authentication (MFA) is one of the most effective security measures available to mobile users, potentially preventing up to 99% of automated attacks.
“Even if credentials are compromised, multi-factor authentication provides a critical secondary defense,” the advisory states.
How to implement MFA effectively:
For critical accounts first:
- Banking and financial services
- Primary email accounts
- Cloud storage with sensitive data
- Social media accounts
Choose the right authentication method:
- Authentication apps (preferred): Google Authenticator, Microsoft Authenticator, Authy
- Hardware keys (most secure): YubiKey, Google Titan
- Biometric verification when available
- SMS codes (least secure, but better than nothing)
For iPhone users:
- Enable two-factor authentication for Apple ID
- Go to Settings > [your name] > Password & Security
- Tap “Turn on Two-Factor Authentication”
- Follow the prompts to complete setup
For Android users:
- Add Google Account 2-Step Verification
- Go to Google Account Settings > Security
- Select “2-Step Verification” and follow prompts
- Consider adding a backup method
For a comprehensive comparison of authentication apps, see our review of Review Apps 2025.
Sharing Personal Information Cautiously
The FBI warns iPhone Android users that information shared online can be weaponized by sophisticated attackers to craft convincing phishing attempts or bypass security questions.
“We’ve observed threat actors compiling comprehensive profiles of potential victims from multiple data sources,” the advisory notes.
Information to protect carefully:
- Full dates of birth
- Home addresses and phone numbers
- Travel plans or locations (especially in real-time)
- Information about children or family members
- Financial details of any kind
- Workplace information and professional relationships
- Photos that reveal location, routine, or security details
Practical steps to minimize your digital footprint:
- Audit your social media privacy settings quarterly
- Use privacy-focused search engines like DuckDuckGo
- Opt out of data broker services using Privacy Bee
- Check for personal data leaks using Have I Been Pwned
- Consider using masked email services and virtual phone numbers
Communicating Safely in the Age of Deepfakes
In a notable addition to previous security advisories, the FBI warns iPhone Android users about threats posed by AI-generated content and deepfake technology targeting mobile users.
Understanding AI-Powered Deepfakes and Voice Cloning
The FBI warns that advances in AI have made it possible to create convincing fake videos, images, and even clone voices with minimal source material. These technologies are increasingly being weaponized for sophisticated scams.
“We’ve documented numerous cases where deepfake technology was used to impersonate family members, colleagues, or romantic interests,” the FBI reports. “In some cases, as little as a three-second voice sample from social media was sufficient to create convincing voice clones used in fraud.”
Particularly concerning threats include:
- “Emergency” video calls from deepfake relatives claiming to be in trouble
- Voice-cloned phone calls from apparent executives requesting wire transfers
- Synthetic intimate images used for blackmail or revenge
- Deepfake videos of public figures spreading misinformation
How to detect potential deepfakes:
- Watch for unnatural blinking patterns or facial movements
- Look for inconsistent lighting or shadows
- Pay attention to strange audio quality or lip synchronization issues
- Be suspicious of poor image quality (often used to hide artifacts)
- Use deepfake detection tools like Sensity AI
Creating a Secret Code for Trusted Communication
In a practical recommendation that reflects the seriousness of voice-cloning threats, the FBI warns iPhone Android users to establish personal verification systems with close contacts.
“Consider establishing code words or phrases known only to you and your closest contacts,” the advisory suggests. “This creates a verification method that AI systems cannot easily replicate.”
How to implement personal verification systems:
- Establish family passwords for emergency situations
- Create personal questions with answers not available online
- Implement callback procedures to verify unexpected financial requests
- Use video calls with specific verification gestures when identity confirmation is critical
- Be skeptical of urgency and requests for unusual payment methods
Legal and Organizational Responses to Cyber Threats
The FBI warns iPhone Android users that addressing mobile security threats is a priority for law enforcement and national security agencies.
FBI’s Ongoing Investigations and Public Warnings
The advisory emphasizes that the FBI is actively investigating major mobile security compromises and working with telecommunications providers to enhance security. They encourage reporting of suspected mobile-related crimes through the Internet Crime Complaint Center (IC3).
“Public reporting is critical to our ability to understand and respond to evolving threats,” the advisory notes. “Even unsuccessful attack attempts provide valuable intelligence about threat actor techniques.”
The FBI is particularly interested in reports involving:
- Suspected state-sponsored mobile surveillance
- Significant financial losses from mobile-based scams
- Unusual or suspicious mobile device behavior
- Apparent interception of communications
- Identity theft linked to mobile compromise
How to report mobile security incidents:
- Document all suspicious activity with screenshots
- Preserve any evidence like texts or emails
- File a report at FBI’s Internet Crime Complaint Center
- Contact your mobile carrier’s fraud department
- File a police report for financial crimes
Partnerships with Other Cybersecurity Organizations
The FBI warns iPhone Android users that they’re working with organizations including the Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and private sector partners to address mobile security challenges.
“Mobile security requires a whole-of-society approach,” the advisory states. “We’re working with device manufacturers, app developers, and network providers to implement more robust security measures.”
Key initiatives include:
- Developing more secure mobile network protocols
- Enhancing app store security review processes
- Creating better standards for secure messaging
- Building automated detection for deepfake content
- Improving public education about mobile security threats
By following the FBI’s recommendations and remaining vigilant about emerging threats, mobile users can significantly reduce their vulnerability to both sophisticated state-sponsored attacks and increasingly convincing scams. As the FBI advisory concludes, “Mobile security is not a one-time action but an ongoing process that requires awareness and regular attention to best practices.”
Security Checklist: Implementing FBI Recommendations
To help you put the FBI’s warnings into action, here’s a practical checklist you can use to secure your mobile device today:
Communication Security:
- Install a secure messaging app (Signal, WhatsApp, or Telegram)
- Move sensitive conversations away from SMS
- Enable disappearing messages for sensitive information
- Verify security keys with important contacts
Device Protection:
- Update to the latest OS version
- Enable automatic updates
- Review app permissions
- Remove unused applications
- Install a reputable mobile security app
Account Security:
- Enable MFA on email, financial, and social accounts
- Use different passwords for each important account
- Install an authentication app
- Check for compromise at HaveIBeenPwned
Anti-Scam Measures:
- Establish verification codes with family for emergencies
- Enable call filtering on your device
- Research unknown callers before responding
- Set up bank alerts for unusual transactions
Remember: Mobile security is an ongoing process, not a one-time setup. Regularly review these settings and stay informed about emerging threats through reliable sources like the FBI Security Alerts.
