Stealth AirTag Clone Bypasses Apple Anti-Stalking

Yes, a researcher has developed a custom AirTag-like tracking device that bypasses Apple’s anti-stalking alerts, demonstrating that the company’s existing safeguards can be circumvented by a determined attacker with moderate technical skill. The device, built from off-the-shelf components, uses a modified Bluetooth protocol to hide its presence from nearby iPhones, raising serious concerns about the effectiveness of current location-tracking protections. This article explains how the clone works, why Apple’s alerts fail, and what this means for your personal safety.

Background: Apple’s Anti-Stalking Features

Apple introduced AirTags in April 2021, and almost immediately concerns arose about their potential for misuse in stalking. In response, Apple implemented a series of anti-stalking measures in iOS, including:

• Unknown AirTag detection: iPhones alert users when an unknown AirTag is traveling with them for a period of time.
• Sound playback: AirTags play a sound when separated from their owner for a while.
• Precision Finding: Users can trigger a precise location of a detected AirTag.
• Android app: Apple released a Tracker Detect app for Android, though it requires manual scanning.

These features rely on the assumption that the tracker will use the standard Apple Find My network and broadcast its identity in a predictable way. The researcher’s clone exploits a fundamental gap in this assumption.

How the Stealth Clone Works

The researcher, who has a background in hardware security, built a device that uses a standard Bluetooth Low Energy (BLE) microcontroller. The key innovation is in how it handles the Bluetooth advertisement packets that AirTags constantly broadcast.

Apple’s anti-stalking detection on iPhones listens for these advertisements and checks for a specific pattern that indicates an AirTag. The clone, however, uses a technique called MAC address randomization in a way that is not yet recognized by Apple’s detection algorithms. Specifically, it rotates its MAC address more frequently than a standard AirTag, and it also alters the advertisement’s payload structure slightly, making it look like a generic BLE device (e.g., a smartwatch or a headphone) rather than an AirTag.

The practical effect is that an iPhone will not flag the device as an unknown tracker, and it will not appear in the “Items That Can Track Youâ€� list in iOS. The clone still communicates with the Find My network (using Apple’s encrypted protocol), so the stalker can locate the device—and thus the victim—on a map, but the victim’s phone is blind to its presence.

Why Apple’s Alerts Fail

The fundamental weakness is that Apple’s detection is based on heuristics, not absolute identification. The system was designed to catch the most common misuse—someone slipping a standard AirTag into a bag or car. It was not designed to catch a device that deliberately mimics other Bluetooth hardware.

Apple’s alerts also have time delays. The “unknown AirTag detectedâ€� notification only appears after the AirTag has been separated from its owner for a period of time (typically 8-24 hours). This gives a stalker a window of opportunity, especially if they are tracking someone in a transient setting, like a bar or a public event. The clone can be programmed to pause its broadcasts or change its behavior during this window, further evading detection.

Furthermore, the detection relies on the victim having an iPhone. Android users are only protected if they manually download Apple’s Tracker Detect app and actively scan for trackers. Most Android users never do this, leaving them completely vulnerable.

Common Problems with Current Protections

Aside from the stealth clone, there are several other known issues with Apple’s anti-stalking features:

• False positives: Users sometimes get alerts about an AirTag that belongs to a friend or family member, causing confusion and anxiety.
• Sound disabled: The anti-stalking sound can be disabled by removing the speaker from the AirTag, a common modification that is widely documented online.
• Android gap: The Tracker Detect app is not a permanent background service; it only scans when the user opens it. It provides no real-time protection.
• Limited to Apple ecosystem: The Find My network is exclusive to Apple devices. If the stalker uses an Android phone, the victim’s iPhone may not detect the tracker at all, because the tracker is not broadcasting in the expected way.

What This Means for Your Safety

This research demonstrates that no consumer tracker is 100% secure against a determined adversary. The threat model for most people is not a sophisticated hardware hacker, but rather an abusive partner or acquaintance who buys a standard AirTag. Apple’s features are effective against that scenario. However, the existence of a stealth clone shows that the protections are not robust.

If you are concerned about being tracked, here are some practical steps you can take:

• Check your phone: On iPhone, go to Settings > Privacy & Security > Tracking Detection (or similar, depending on iOS version) to see if any unknown trackers are found.
• Scan manually: Use the Tracker Detect app on Android periodically, especially if you are in a new place.
• Look for physical signs: Check your belongings, car, and clothing for small, unfamiliar devices. AirTags are about the size of a coin.
• Use a Bluetooth scanner: Apps like “BLE Scannerâ€� can list all nearby Bluetooth devices, including those with randomized MAC addresses. If you see an unknown device that is consistently present, it could be a tracker.

Alternatives and Future Directions

The researcher’s work is not intended to help stalkers, but to highlight the need for better protections. Apple has a history of improving security in response to research, and it is likely that future iOS updates will close this specific gap. However, the cat-and-mouse game will continue.

In the meantime, there are other tracking devices on the market (e.g., Tile, Samsung SmartTag) that have their own anti-stalking measures, but they also have similar weaknesses. The most effective protection is a combination of technology and awareness.

Some privacy advocates suggest that Apple should make the Find My network more open, allowing third-party security researchers to audit the detection algorithms. Others suggest that the anti-stalking alerts should be more aggressive, even if it means more false positives.

Frequently Asked Questions

Can I buy this stealth AirTag clone?

No, the researcher has not released the device for sale, and the code has not been published. The purpose of the research was to demonstrate a vulnerability, not to provide a tool for abuse. Building such a device requires significant technical expertise in embedded systems and Bluetooth protocols.

Does this affect Android users more than iPhone users?

Yes, Android users are already at a disadvantage because Apple’s detection is iOS-centric. The stealth clone makes the problem worse because it is invisible to both platforms. Android users have no built-in detection at all, and the Tracker Detect app is not a real-time solution.

Will Apple fix this with a software update?

It is likely that Apple will eventually update its detection algorithms to recognize the patterns used by this clone. However, the researcher could then modify the clone again. This is a continuous arms race. Apple has a strong incentive to fix the issue, as it directly affects user safety and trust.

How can I tell if I’m being tracked by a stealth device?

It is very difficult without specialized equipment. You can use a Bluetooth scanner app to look for unknown devices that appear consistently. However, the clone is designed to blend in, so it may not be obvious. Physical inspection of your belongings is the most reliable method.

Is it legal to build or use such a device?

Using any device to track someone without their consent is illegal in most jurisdictions, and it is considered stalking. Building the device for research purposes may be legal, but using it for malicious purposes is a crime. This article is for informational purposes only and does not condone illegal activity.

Related

• Expandable Housing & Faster Project Delivery
• Duplicate File Removal: What to Remember
• Convert FAT32 to NTFS Without Losing Data? Yes, Here’s How