Apps Marketed to US Troops Are Shipping Chinese and Russian Code
Study finds over 12% of apps marketed to US troops contain code from Chinese, Russian, and other foreign vendors.
Researchers from Purdue, West Point, and FIU analyzed 220+ mobile apps marketed to US military personnel and found that 12.5% contained third-party code from adversarial nations, including Huawei SDKs and Russian ad services. The discovery raises concerns that hostile governments could exploit location tracking and personal data to identify troop deployments, unit movements, and sensitive facility access. This research highlights a decade-long warning about the data-broker economy's threat to military personnel, recently confirmed when US Central Command acknowledged adversaries are exploiting commercial location data to target American forces in active war zones.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonResearchers discovered that over 12% of mobile apps marketed to US troops contained third-party SDKs and ad libraries originating from China and Russia, introducing covert data collection capabilities into devices used by military personnel. The root cause is a failure in supply chain oversight — neither app developers nor end users scrutinized the origin of embedded third-party code, allowing adversarial nation components to reach sensitive user populations by default. This matters because location telemetry, behavioral data, and device identifiers harvested through these SDKs can be aggregated by hostile intelligence services to map troop movements, identify deployment patterns, and expose sensitive facility access. US Central Command has already confirmed adversaries are actively exploiting commercial location data to target American forces in active combat zones, making this a kinetic, life-safety risk — not merely a privacy concern.
What helps against this
How we list vendors- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — HMS Core (Huawei Mobile Services Core)
- malware — Yandex (Russian ad service)