Security flaw in popular stalkerware apps is exposing phone data of millions

(Image credit: Kaspersky)

Cocospy and Spyic were found to be leaking sensitive information
The developers are not responding and the bugs have not been fixed
People's photos, messages, call logs, and more, are at risk

Email addresses, text messages, call logs, photographs, and other sensitive data, belonging to millions of people may have been exposed online thanks to a pair of faulty spyware applications.

Spyware apps, often also called “spouseware”, are apps that people covertly install on mobile devices belonging to their partners, children, or similar. They are advertised as legitimate monitoring apps, but are essentially operating in the grey zone and are not allowed on major app stores, such as the App Store or Play Store.

A cybersecurity researcher recently analyzed Cocospy and Spyic, two popular spyware apps whose code apparently has significant overlaps which allowed the researcher to pull sensitive information from their servers.

Email addresses and more

TechCrunch, which first reported on the findings, said the bug was “relatively simple to exploit”, but in order to protect the victims, decided not to share any details at this time.

When a person wants to install the spyware on someone else’s device, they first need to use an email address to register an account.

The researcher managed to exfiltrate 1.81 million of email addresses used to register with Cocospy, and roughly 880,000 addresses used for Spyic. Besides email addresses, the researcher managed to access most of the data harvested by the apps, including pictures, messages, and call logs.

Due to the nature of the apps, the developers try their best to remain hidden and out of reach. TechCrunch deduced that the developers are most likely of Chinese origin, but could not say for certain - although there is some evidence that the developer might be 711.icu, whose website isn’t even loading.

The operators did not respond to media inquiries and have not, at press time, addressed the vulnerabilities.

Two notorious stalkerware apps appear to finally have been taken offline following court ruling
We've rounded up the best password managers
Take a look at our guide to the best authenticator app

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.