Apple AirTag tracking can be misled by replayed Bluetooth signals

Researchers demonstrated a practical relay attack on Apple’s Find My network whereby Bluetooth LE advertisements from an AirTag are captured, transmitted over the internet, and replayed elsewhere to inject false location reports; the report explains the attack flow, experimental setup, how Find My prioritizes local vs cloud reports and key rotation limits reuse (but replayed signals can persist for days under some conditions).