What is a Stingray attack: symptoms, how it works, and how to protect yourself

It's probably no secret that hackers and other malicious actors are constantly refining their attacks to make them more effective and harder to detect. Among these advanced techniques, one in particular worries mobile cybersecurity experts: Stingray attacks.

Protecting yourself is very important, because this system has the ability to obtain a large amount of information from our phone without us being aware of it, and it does so massively, capturing data from all devices within its range.

What is a Stingray attack or IMSI-catcher?

This type of cybercrime is also known as an IMSI-catcher attack , short for International Mobile Subscriber Identity catcher . Behind this complex name lies a technique that uses a device to simulate a legitimate cell tower and deceive nearby mobile phones.

A Stingray is, technically, a mobile communications interceptor that acts as a fake base station . It emits a very powerful radio signal so that phones in the area connect to it, mistaking it for a real cell tower. In this way, it positions itself as an intermediary between the mobile phone and the cellular network, a phenomenon known as a man-in-the-middle attack at the cellular network level.

To make mobile telephony as convenient as it is, phones automatically connect to the tower with the strongest signal . If you're walking down the street, your phone might switch between towers to provide the best coverage. While this is very useful for staying connected, it has also become a new risk.

What the Stingray does is emit a signal that's stronger than those emitted by nearby cell towers . As a result, phones within its range connect to it without showing anything unusual to the user. The signal icon will still appear normally, and you'll still have calls and data, but everything will pass through the attacker's device first.

While phishing attempts to trick us into granting access to our data, this attack directly tricks our mobile phone , exploiting how the cellular network works beneath the operating system.

Once the connection to the fake tower has been established, the attacker can begin collecting information such as:

• IMSI number (International Mobile Subscriber Identity, the unique identifier of the SIM card).
• IMEI or device identifiers (in advanced equipment), which allow the SIM to be associated with a specific terminal.
• Call metadata: who calls us, who we call, when, from where and how long we talk.
• SMS message content, if the use of weak encryption standards is forced.
• Precise device location, obtained through triangulation of the signal and the received power.
• Registration of all devices in the areaeven if the attacker is only interested in one specific person, because data capture is indiscriminate.

Stingrays were originally designed by military and law enforcement agencies to track criminals and persons of interest in investigations. Over time, their use has also been documented in monitoring demonstrations and protests. Today, commercial versions or copies of this technology are available to foreign governments, private companies, and cybercriminals , greatly increasing the potential risk to any user.

How a Stingray works on a technical level

To better understand the danger, it's helpful to know in simple terms how a Stingray operates. These devices are typically portable hardware units (briefcase-sized or integrated into vehicles) that include:

• Un cellular communications modem capable of speaking the same protocols used by mobile networks (2G, 3G, 4G, etc.).
• High gain antennas for amplify the signal and surpass the power of nearby legitimate towers.
• Specialized software for manage mobile connections, register identifiers and, in advanced versions, lower the level of communication security.

The simplified process would be:

1. The Stingray turns on and announces a mobile network with parameters similar to those of a real operator (name, frequency band, network type).
2. Because it emits at high power, nearby mobile phones detect it as the best coverage option and they connect automatically.
3. The devices send their IMSI, IMEI and other signaling data, which the Stingray records in order to track them.
4. The attacker can allow the traffic to pass through to the real network (so the user doesn't notice anything) or intercept, modify or block communications.
5. In many cases, the Stingray forces phones to use 2G, a very old standard with almost no encryption, which facilitates interception.

It's important to note that it doesn't just target one individual . It captures data from all devices within its range and then, at the software level, filters by the IMSI or IMEI of the person it's actually targeting. This means that thousands of unsuspecting users could have their privacy compromised without even knowing it.

What can happen if your phone falls victim to this attack?

The consequences depend on whether it is a passive or active interception :

In passive interception , the Stingray simply observes and records data without modifying the traffic. This mode collects the data mentioned earlier: IMSI, IMEI, call metadata, location, SMS messages in some cases, etc. The attacker can:

• Build a detailed history of your transactions and daily routines (where you live, where you work, what places you frequent).
• Analyze who you communicate with, how often, and at what times, generating a relationship map.
• Identify the presence of certain people in a specific area (for example, at a protest or meeting).

In active interception , which is much worse, the attacker can go beyond simple observation. By positioning themselves as an actual intermediary in the communication, they can:

• Intercept and redirect your calls or messagesso that they can pass through other espionage or recording systems.
• Alter the content SMS messages (for example, to manipulate two-factor verification codes sent by banks or online services).
• Submit fake SMS messages that appear to come from legitimate sources (your operator, your bank, a well-known company), taking advantage of the fact that in 2G there is hardly any sender authentication.
• Combining the use of Stingray with campaigns smishingsending messages with malicious links to steal credentials or install malware.

Some sophisticated Stingray models can cause phones to lower their security level and disable encryption, enabling them to actively listen to everything said near the affected devices or, at the very least, to everything transmitted by voice over the network. They can also cause service degradation (dropping from 4G/5G to 2G) without the user understanding why.

In contexts of mass surveillance, the use of these devices by some authorities to monitor protesters, journalists, or activists has been documented . The problem is that, because they operate indiscriminately, they also capture the data of hundreds or thousands of innocent people , with serious implications for privacy and fundamental rights.

How can I tell if I've been a victim of a Stingray attack?

One of the characteristics of this form of espionage and data collection is that it is so discreet that victims often don't realize what is happening . No notifications or clear messages appear on the phone.

Even so, it is not a foolproof system, and there are a number of signs or symptoms that can alert us that something is wrong at the mobile network level:

• Sudden network changes from 4G/5G to 2GThe 2G standard is much more vulnerable and is the one typically used by Stingrays. If you notice that in an area with good coverage your phone suddenly drops to 2G for no apparent reason, it could be a warning sign.
• The quality of calls and/or connections suddenly dropsFrequent dropouts, excessive delay, strange echo, or constant failures to establish the call are suspicious behaviors.
• The phone overheats or drains the battery very quicklyThis happens because the device may be making multiple connection attempts, switching between towers, or retrying the link with an unstable base station.
• Strange network behavior: outages, unexpected disconnections, inability to make or receive calls in an area where there are normally no problems.
• SMS messages arriving from seemingly legitimate senders (from operators, banks, or well-known companies) but with strange content, grammatical errors, unusual links, or requests for sensitive data. If your phone is also on 2G, the suspicion should increase.

None of these symptoms, on their own, confirms that you're dealing with a Stingray, as they could also be due to network outages or problems with the device itself. However, if several signs appear simultaneously in a sensitive context (demonstrations, government areas, mass events), it's wise to take extra security precautions.

How to defend against a Stingray attack?

We may not be able to completely prevent these kinds of intrusions, because they are network and hardware attacks over which the user has little direct control. But we can protect ourselves to reduce the risk of becoming victims of cybercriminals or abusive surveillance, and above all, we can minimize the impact if interception occurs.

End-to-end encryption for calls and messages

The well-known end-to-end encryption used by apps like WhatsApp, Telegram, and Signal is one of the best ways to protect communications. Even if the Stingray intercepts the connection or sees the data traffic, it won't be able to decrypt the messages sent or the content of encrypted calls within these applications.

This is because the information is encrypted on your device and only decrypted on the recipient's. Neither the carrier, nor the mobile manufacturer, nor a Stingray in between can access the content, only metadata (such as the fact that you have connected).

Therefore, we recommend using only end-to-end encryption apps for your sensitive messages and calls . Avoid, whenever possible, sending confidential data via SMS or conventional mobile network voice calls, which are much easier to intercept if the connection degrades to 2G.

Turn off 2G networks whenever possible

Many Stingray attacks rely on forcing phones to use 2G because it's a very old standard with almost no encryption or authentication measures . If your device never connects to 2G, it will be much harder for an attacker to spy on your communications.

Check if your phone has this option. On many recent Android devices, you can go to: Settings > Mobile network > Preferred network type or in the SIM section and look for an option similar to Allow 2G . Disable 2G from there, so your phone won't automatically switch to more vulnerable networks.

Keep in mind some important nuances:

• In some devices and customization layers, the option may not appear; it will depend on the manufacturer and the integrated modem.
• In certain countries or rural areas, disabling 2G may result in losing coverage in areas where modern networks do not reach.
• In iOS, this system-level option is available on many models. not availableTherefore, protection against network degradation is more limited.

Even so, when your coverage environment allows it, blocking 2G is one of the most effective defenses against Stingrays that try to degrade the connection.

Use a VPN to protect your browsing

A VPN won't keep you safe from the interception of calls or SMS messages , because these use the mobile network itself, but it will protect your internet browsing when you use mobile data or Wi-Fi.

When you connect to a VPN, an encrypted tunnel is created between your device and the VPN server. All traffic leaving your mobile device to the internet (websites, apps, online services) will travel protected, so even if a Stingray or any other attacker intercepts the packets at the cellular network level, they will only see encrypted data and will not be able to read the content.

Additionally, when using a VPN:

• You will reduce the attacker's ability to associate your data traffic with your exact locationbecause for online services your visible IP will be that of the VPN server.
• You can avoid certain forms of censorship or geographic blockingwhich is not directly related to the Stingray but does add protection and privacy.

However, you should always choose VPN providers with a good reputation for privacy and avoid suspiciously free services that may monetize your data.

Turn off your phone or use airplane mode in sensitive areas.

The Stingray attack is indiscriminate. It doesn't target individual users, but rather attempts to ensnare many victims simultaneously . Precisely for this reason, there is a greater risk of such a device being used in crowded or high-profile areas : demonstrations, political rallies, large events, the vicinity of government buildings, etc.

If you're going to a concert, a demonstration, or an important meeting and you're particularly concerned about your privacy, it's best to turn off your phone or at least put it in airplane mode . This cuts off all cellular communication and protects you from IMSI capture, location tracking, and call metadata.

Some practical recommendations:

• Activate airplane mode before reaching the sensitive areato prevent your entry from being registered.
• If you need to use the phone, you can activate only the Wi-Fi without reactivating the mobile networkHowever, this does not protect you against other forms of wireless surveillance.
• Avoid carrying multiple SIM cards unless absolutely necessary, as Each SIM has its own IMSI that could be registered.

Use detectors and network analysis tools

You shouldn't obsess over this, but if you want more protection you can use devices and solutions like SnoopSnitch (on rooted Android) or Crocodile Hunter.

These tools analyze the behavior of nearby towers to detect potential anomalies: base stations that suspiciously change parameters, networks that advertise inconsistent capabilities, unjustified downgrades to 2G, etc. While not infallible, they can help you identify potentially dangerous environments.

Please note that using these apps usually requires:

• Devices unlocked or with root accessbecause they need to read advanced information from the modem.
• Some technical knowledge to interpret the results and avoid generating false alarms.

Use operating systems and mobile devices with advanced security.

In recent years, mobile platforms have incorporated specific measures to better defend against fake cell towers . Some recent versions of Android include:

• The option of disable 2G connectivity at the system level.
• Controls for block connections to unencrypted networks or considered unsafe.
• Functions of Warning when the phone connects to a suspicious networkFor example, if the base station abnormally requests identifiers such as IMSI or IMEI.

It has been confirmed that Android 16 will incorporate (or incorporated, depending on the rollout) a warning system that will notify the user when their phone connects to a mobile network considered unsafe or suspicious—for example, unencrypted networks or base stations that request identifiers such as IMSI or IMEI—which will help detect potential Stingray attacks.

These capabilities depend in part on the modem hardware and specific internal interfaces, so not all devices on the market will be able to take advantage of them, even if they have a modern version of Android.

There are also other operating systems that offer greater control over network connections and permissions. One example is GrapheneOS , which is based on Android and focuses on advanced security and privacy, with additional restrictions on access to identifiers, system hardening, and stricter options for controlling which apps can use the network.

If privacy is a priority for you, you might be interested in considering:

• Devices that receive frequent security updates and for several years.
• Models that offer specific 2G blocking options and unsafe network warnings.
• ROMs or alternative systems with granular controls over permits and connections.

It combines network protection with malware protection.

One aspect that often goes unnoticed is that attackers can combine the use of a Stingray with malware installed on the device. For example, they might use fake SMS messages to lure you to a malicious website from which to download spyware or fraudulent applications.

Although security applications cannot directly detect an IMSI catcher , they can provide a strong barrier against software-based threats that rely on these network attacks. Maintaining good antivirus and antispyware solutions and keeping your system up to date greatly reduces the risk of a Stingray attack becoming the first step in a more serious compromise.

Therefore, in addition to protecting your network:

• Install apps only from official stores and always check the permissions.
• Be wary of links in SMS messages that ask for bank details or credentials.
• Perform periodic scans with tools specializing in spyware and stalkerware.

Now that you know what a Stingray attack is and how it relates to the inner workings of the mobile network, you're more likely to be suspicious if you notice anything unusual with your mobile connection: sudden switches to 2G, poor call quality, suspicious SMS messages, or other anomalous network behavior. If this happens in a sensitive situation, turn off your device or put it in airplane mode and don't turn it back on until you're some distance away from the affected area. We live in a hyper-connected world where digital threats are a part of everyday life, and understanding these techniques, along with the protective measures available to you, allows you to better safeguard your privacy and communications.