WSJ: 1.2B Internet Cameras Now Spy Tools Across War Fronts

Hacked security cameras have become working reconnaissance infrastructure for four active conflicts, the Wall Street Journal reported, with roughly 1.2 billion internet-connected cameras worldwide (doorbells, baby monitors, traffic cams, license-plate readers) now serving as a usable attack surface for state intelligence services and their proxies.

Israel reportedly infiltrated Tehran's traffic camera network to monitor senior Iranian officials and collect information used in planning military operations, including the February 28 strike that killed Supreme Leader Ali Khamenei. Running the other direction, Iranian-linked groups have breached more than 250 cameras in Israel this year that the National Cyber Directorate considers sensitive to national security, including license plate readers and cameras near military outposts along the Lebanese border. The Iran-linked group Handala taunted Israelis through the devices: 'Have a message? Find the nearest traffic camera and talk.'

Ukraine's security service says it has identified, repositioned, or blocked 40,000 cameras since Russia's 2022 invasion. The pro-Ukraine hacker group Team OneFist took over a camera in Sevastopol in 2022; by 2024, Russian hackers were running residential webcams inside Kyiv.

The attack path is cheap. 'Their job is to mount that camera, power it on, and walk away,' said Xu Zou, a senior vice president at Palo Alto Networks, describing installers whose defaults never get changed. Intelligence services run automated tools that test millions of passwords, and image-recognition software then sifts the feeds for military vehicles and weapons. Dutch intelligence agencies issued a public advisory about the pattern on July 10, 2026, and Israel's National Cyber Directorate has warned separately, with cybersecurity expert Eliav Noori calling the breached devices 'lookout points.'

The spillover reaches living rooms. Ondrej Svoboda, a cybersecurity company employee in Prague whose baby monitor was hijacked in 2023, told the paper: 'I didn't think this was something that could happen to me.' Our cybersecurity tracker has logged 207 stories in the last 90 days; the camera-as-weapon turn is distinct because the surveillance primitives for a shooting war are already installed, by homeowners and city agencies, inside the target country.