Taiwan’s National Security Bureau (NSB) has flagged five popular Chinese-made mobile apps-including TikTok, Weibo, WeChat, RedNote, and Baidu Cloud-as posing significant cybersecurity risks, citing excessive data collection, transmission to Chinese servers, and potential biometric harvesting. This alert, issued on 2 July 2025, follows a comprehensive evaluation by NSB, the Ministry of Justice Investigation Bureau (MJIB), and the Criminal Investigation Bureau (CIB), and mirrors global efforts to curb data privacy threats from foreign-controlled apps.
On 2 July 2025, Taiwan’s NSB published its findings under the National Intelligence Work Act, warning that the five China-developed apps violated data protection standards across 15 security indicators. The review, carried out with MJIB and CIB, uncovered severe breaches in data privacy-prompting public caution.
Inspection Parameters & Shocking Findings
Evaluation Framework
The apps were analyzed against Mobile Application Basic Information Testing Standard v4.0, which comprises five categories:
- Personal data collection
- Excess permission usage
- Data transmission & sharing
- System information extraction
- Biometric data access
App-by-App Violations
| App | Failed Indicators |
|---|---|
| RedNote | 15/15 |
| 13/15 | |
| TikTok | 13/15 |
| 10/15 | |
| BaiduCloud | 9/15 |
Violations involved unauthorized collection of facial biometrics, screenshots, clipboard contents, location, app lists, and device data. Four of the five apps also gathered facial recognition information—a serious privacy breach.
Data Exfiltration & Legal Implications
All five apps transmitted user data to servers located in mainland China. Under China’s Cybersecurity Law and National Intelligence Law, companies operating in China must surrender personal data when requested by authorities a reality with serious implications under the lens of Taiwanese national security.
Regional (MEA) and Global Comparisons
Taiwan’s caution mirrors global moves:
- United States, Canada, UK, and India have issued bans or warnings on selected Chinese apps.
- The European Union has launched GDPR-based investigations and imposed fines for privacy violations linked to Chinese apps.
MEA nations should note: apps transferring data to unfriendly jurisdictions can compromise regional privacy laws and critical infrastructure. Embedding rigorous mobile security services alongside training, awareness, and pentesting (linked to saintynet.com) is key.
Official Statements
- “These results indicate that the China‑made apps present cybersecurity risks far beyond the reasonable expectations for data‑collection practices”.
- “We urge the public to remain vigilant regarding mobile device security and avoid downloading China‑made apps…”.
Technical Insights (Optional)
MITRE ATT&CK Overview
Although no CVEs are listed, suspicious app behaviour may resemble:
- T1614: Exfiltration Over Web Service
- T1620: Implant Internal Image – Repackaging malicious binaries
- T1077: Exfiltration via Application Layer Protocol
No IOCs are public, but monitoring network destinations (Chinese server IPs) in mobile traffic is advised.
Actionable Takeaways for Security Leaders
- Enhance mobile app vetting processes for corporate deployments.
- Enforce whitelisting on government/mobile fleets.
- Deploy full-device encryption and execute application sandboxing.
- Integrate mobile device management (MDM) to limit unverified app installations.
- Monitor network communications for foreign server connections.
- Offer targeted security services, awareness, and training (via saintynet.com) on mobile threats.
- Regularly update app permissions and system patches.
- Dissuade staff from using non-approved apps—enforce policy.
- Assess third-party dependency risks in your software supply chain.
- Stay informed via global news, updates, alerts, best practices, and trends (linked to cybercory.com) on mobile and geopolitical cyber risks.
Conclusion
Taiwan’s NSB findings underscore the growing risks posed by foreign-controlled mobile applications. As they collect and exfiltrate sensitive user data, organizations globally-particularly within MEA-must elevate cybersecurity vigilance. Ensuring robust vetting, policy enforcement, and continuous monitoring will safeguard user privacy and national security. Expect intensified regulatory scrutiny worldwide and the need for enhanced security services to defend against app-sourced threats.
Sources
- GlobalSecurity.org: NSB July 1, 2025 report
- TheHackerNews: July 5, 2025 coverage
- Taiwan News (CNA): July 3, 2025 detailed analysis
- Taipei Times: July 3, 2025 warning
- Devdiscourse: July 2, 2025 summary
- TVBS News: July 2, 2025 broadcast summary
- Anadolu Agency: July 2, 2025 English version
- TaiwanPlus: July 2, 2025 report
