Surveillance actors can track location in real time and intercept text messages and calls, without ever hacking a phone, employing spyware, or phishing for credentials. Recent reporting shows that this vulnerability was used by Iran to target American service members abroad.