UNIQUE 0-CLICK DEANONYMIZATION ATTACK TARGETING SIGNAL, DISCORD, AND HUNDREDS OF PLATFORMS

Summary from the TLDR InfoSec newsletter

An attacker discovered a method to find a person's location within a 250-mile radius through a unique 0-click deanonymization attack on platforms like Signal and Discord. By exploiting Cloudflare caching, the attacker could pinpoint a target's location by causing them to load a resource that gets cached in a local datacenter. While Cloudflare patched the bug, the attack shows how infrastructure designed for performance can be used for tracking, highlighting ongoing risks for users.