A security vulnerability in a pair of phone-monitoring apps is exposing the personal data of millions of people who have the apps unwittingly installed on their devices, according to a security researcher who found the flaw.
The bug allows anyone to access the personal data — messages, photos, call logs, and more — exfiltrated from any phone or tablet compromised by Cocospy and Spyic, two differently branded mobile stalkerware apps that share largely the same source code. The bug also exposes the email addresses of the people who signed up to Cocospy and Spyic with the intention of planting the app on someone’s device to covertly monitor them.
Much like other kinds of spyware, products like Cocospy and Spyic are designed to remain hidden on a victim’s device while covertly and continually uploading their device’s data to a dashboard visible by the person who planted the app. By nature of how stealthy spyware can be, the majority of phone owners are likely unaware that their devices have been compromised.
The operators of Cocospy and Spyic did not return TechCrunch’s request for comment, nor have they fixed the bug at the time of publishing.
The bug is relatively simple to exploit. As such, TechCrunch is not publishing specific details of the vulnerability so as to not help bad actors exploit it and further expose the sensitive personal data of individuals whose devices have already been compromised by Cocospy and Spyic.
The security researcher who found the bug told TechCrunch that it allows anyone to access the email address of the person who signed up for either of the two phone-monitoring apps.
The researcher collected 1.81 million email addresses of Cocospy customers and 880,167 email addresses of Spyic customers by exploiting the bug to scrape the data from the apps’ servers. The researcher provided the cache of email addresses to Troy Hunt, who runs data breach notification service Have I Been Pwned.
Hunt told TechCrunch that he loaded a combined total of 2.65 million unique email addresses registered with Cocospy and Spyic to Have I Been Pwned, after he removed duplicate email addresses that appeared in both batches of data. Hunt said that as with previous spyware-related data breaches, the Cocospy and Spyic cache is marked as “sensitive,” in Have I Been Pwned, which means that only the person with an affected email address can search to see if their information is in there.
Cocospy and Spyic are the latest in a long list of surveillance products that have experienced security mishaps in recent years, often as a result of bugs or poor security practices. By TechCrunch’s running count, Cocospy and Spyic are now among the 23 known surveillance operations since 2017 that have been hacked, breached, or otherwise exposed customers’ and victims’ highly sensitive data online.
Phone-monitoring apps like Cocospy and Spyic are typically sold as parental control or employee-monitoring apps but are often referred to as stalkerware (or spouseware), as some of these products expressly promote their apps online as a means of spying on a person’s spouse or romantic partner without their knowledge, which is illegal. Even in the case of mobile surveillance apps that are not explicitly marketed for nefarious activity, often the customers still use these apps for ostensibly illegal purposes.
Stalkerware apps are banned from app stores and so are usually downloaded directly from the stalkerware provider. As a result, stalkerware apps usually require physical access to someone’s Android device to be planted, often with prior knowledge of the victim’s device passcode. In the case of iPhones and iPads, stalkerware can tap into a person’s device’s data stored in Apple’s cloud storage service iCloud, which requires using their stolen Apple account credentials.
Stalkerware with a China nexus
Little else is known about these two spyware operations, including who runs Cocospy and Spyic. Stalkerware operators often try to eschew public attention, given the reputational and legal risks that go with running surveillance operations.
Cocospy and Spyic launched in 2018 and 2019, respectively. From the number of registered users alone, Cocospy is one of the largest-known stalkerware operations going today.
Security researchers Vangelis Stykas and Felipe Solferini, who analyzed several stalkerware families as part of a 2022 research project, found evidence linking the operation of Cocospy and Spyic to 711.icu, a China-based mobile app developer, whose website no longer loads.
This week, TechCrunch installed the Cocospy and Spyic apps on a virtual device (which allows us to run the apps in a safe sandbox without giving either of the spy services any real-world data, such as our location). Both of the stalkerware apps masquerade as a nondescript-looking “System Service” app for Android, which appears to evade detection by blending in with Android’s built-in apps.
We used a network analysis tool to watch data flowing in and out of the app to understand how the spyware operations work, what data is shared, and where the servers are located.
Our traffic analysis found the app was sending our virtual device’s data via Cloudflare, a network security provider that obfuscates the true real-world location and web host of the spyware operations. But some of the web traffic showed the two stalkerware apps were uploading some victims’ data, like photos, to a cloud storage server hosted on Amazon Web Services.
Neither Amazon nor Cloudflare responded to TechCrunch’s inquiries about the stalkerware operations.
The analysis also showed that while using the app, the server would occasionally respond with status or error messages in Chinese, suggesting the apps are developed by someone with a nexus to China.
What you can do to remove the stalkerware
The email addresses scraped from Cocospy and Spyic allow anyone who planted the apps to determine if their information (and their victim’s data) was compromised. But the data does not contain enough identifiable information to notify individuals whose phones are compromised.
However, there are things you can do to check if your phone is compromised by Cocospy and Spyic. Like most stalkerware, both of these apps rely on a person deliberately weakening the security settings on an Android device to plant the apps — or in the case of iPhones and iPads, accessing a person’s Apple account with knowledge of their username and password.
Even though both Cocospy and Spyic try to hide by appearing as a generic-looking app called “System Service,” there are ways to spot them.
With Cocospy and Spyic, you can usually enter ✱✱001✱✱ on your Android phone app’s keypad and then press the “call” button to make the stalkerware apps appear on-screen — if they are installed. This is a feature built into Cocospy and Spyic to allow the person who planted the app on the victim’s device to regain access. In this case, the feature can also be used by the victim to determine if the app is installed.
You can also check your installed apps through the apps menu in the Android Settings menu, even if the app is hidden from view.
TechCrunch has a general Android spyware removal guide that can help you identify and remove common types of phone stalkerware. Remember to have a safety plan in place, given that switching off spyware may alert the person who planted it.
For Android users, switching on Google Play Protect is a helpful safeguard that can protect against malicious Android apps, including stalkerware. You can enable it from Google Play’s settings menu if it isn’t already enabled.
And if you’re an iPhone and iPad user and think you may be compromised, check that your Apple account uses a long and unique password (ideally saved in a password manager) and that your account also has two-factor authentication switched on. You should also check and remove any devices from your account that you don’t recognize.
If you or someone you know needs help, the National Domestic Violence Hotline (1-800-799-7233) provides 24/7 free, confidential support to victims of domestic abuse and violence. If you are in an emergency situation, call 911. The Coalition Against Stalkerware has resources if you think your phone has been compromised by spyware.
Contact Zack Whittaker securely on Signal and WhatsApp at +1 646-755-8849. You can also share documents securely with TechCrunch via SecureDrop.
ADVERTISEMENT:
Informasi mengenai KING SLOT, Segera Daftar Bersama king selot terbaik dan terpercaya no satu di Indonesia. Boleh mendaftar melalui sini king slot serta memberikan hasil kembali yang paling tinggi saat sekarang ini hanyalah KING SLOT paling gacor, gilak dan gaco saat sekarang di Indonesia melalui program return tinggi di kingselot serta pg king slot
suara88 permainan paling top dan garansi imbal balik hasil besar bersama https://suara88.biz/
sumo7777 permainan paling top dan garansi imbal balik hasil besar bersama https://sumo7777.com/
supermoney888 permainan paling top dan garansi imbal balik hasil besar bersama https://supermoney888.biz/
teratai88 permainan paling top dan garansi imbal balik hasil besar bersama https://teratai88.biz/
thor88 permainan paling top dan garansi imbal balik hasil besar bersama https://thor88.biz/
togelhk88 permainan paling top dan garansi imbal balik hasil besar bersama https://togelhk88.net/
topjitu88 permainan paling top dan garansi imbal balik hasil besar bersama https://topjitu88.net/
totosloto88 permainan paling top dan garansi imbal balik hasil besar bersama https://totosloto88.com/
trisula888 permainan paling top dan garansi imbal balik hasil besar bersama https://trisula888.biz/
udangbet88 permainan paling top dan garansi imbal balik hasil besar bersama https://udangbet88.net/
via88 permainan paling top dan garansi imbal balik hasil besar bersama https://via88.biz/
virusjp88 permainan paling top dan garansi imbal balik hasil besar bersama https://virusjp88.net/
warga888 permainan paling top dan garansi imbal balik hasil besar bersama https://warga888.biz/
waw88 permainan paling top dan garansi imbal balik hasil besar bersama https://waw88.biz/
winjitu88 permainan paling top dan garansi imbal balik hasil besar bersama https://winjitu88.net/
wisdom88 permainan paling top dan garansi imbal balik hasil besar bersama https://wisdom88.biz/
wnitogel88 permainan paling top dan garansi imbal balik hasil besar bersama https://wnitogel88.com/
yoyo888 permainan paling top dan garansi imbal balik hasil besar bersama https://yoyo888.biz/
validtoto88 permainan paling top dan garansi imbal balik hasil besar bersama https://validtoto88.com/
sule999 permainan paling top dan garansi imbal balik hasil besar bersama https://sule999.com/
sule88 permainan paling top dan garansi imbal balik hasil besar bersama https://sule88.org/
ss888bet permainan paling top dan garansi imbal balik hasil besar bersama https://ss888bet.com/
sia77 permainan paling top dan garansi imbal balik hasil besar bersama https://sia77.info/
seluang88 permainan paling top dan garansi imbal balik hasil besar bersama https://seluang88.com/
satu88 permainan paling top dan garansi imbal balik hasil besar bersama https://satu88.biz/
satu777 permainan paling top dan garansi imbal balik hasil besar bersama https://satu777.asia/
rp88 permainan paling top dan garansi imbal balik hasil besar bersama https://rp88.biz/
rp88 permainan paling top dan garansi imbal balik hasil besar bersama https://rp88.asia/
rp88 permainan paling top dan garansi imbal balik hasil besar bersama https://rp77.live/
qiuqiu88 permainan paling top dan garansi imbal balik hasil besar bersama https://qiuqiu88.biz/
pt88 permainan paling top dan garansi imbal balik hasil besar bersama https://pt88.org/
pt77 permainan paling top dan garansi imbal balik hasil besar bersama https://pt77.info/
produk88 permainan paling top dan garansi imbal balik hasil besar bersama https://produk88.asia/
mt88 permainan paling top dan garansi imbal balik hasil besar bersama https://mt88.org/
mt77 permainan paling top dan garansi imbal balik hasil besar bersama https://mt77.biz/
menang66 permainan paling top dan garansi imbal balik hasil besar bersama https://menang66.biz/
latobet888 permainan paling top dan garansi imbal balik hasil besar bersama https://latobet888.org/
kedai96 permainan paling top dan garansi imbal balik hasil besar bersama https://kedai96.org/
kedai188 permainan paling top dan garansi imbal balik hasil besar bersama https://kedai188.biz/
ids88 permainan paling top dan garansi imbal balik hasil besar bersama https://ids88.biz/
hp88 permainan paling top dan garansi imbal balik hasil besar bersama https://hp88.org/
hp77 permainan paling top dan garansi imbal balik hasil besar bersama https://hp77.org/
gm88 permainan paling top dan garansi imbal balik hasil besar bersama https://gm88.asia/
gm77 permainan paling top dan garansi imbal balik hasil besar bersama https://gm77.net/
final888 permainan paling top dan garansi imbal balik hasil besar bersama https://final888.org/
duit88 permainan paling top dan garansi imbal balik hasil besar bersama https://duit88.asia/
duit168 permainan paling top dan garansi imbal balik hasil besar bersama https://duit168.biz/
divisi88 permainan paling top dan garansi imbal balik hasil besar bersama https://divisi88.org/
dewi500 permainan paling top dan garansi imbal balik hasil besar bersama https://dewi500.biz/
devil88 permainan paling top dan garansi imbal balik hasil besar bersama https://devil88.info/
cuputoto88 permainan paling top dan garansi imbal balik hasil besar bersama https://cuputoto88.com/
cukongbet88 permainan paling top dan garansi imbal balik hasil besar bersama https://cukongbet88.asia/
bom888 permainan paling top dan garansi imbal balik hasil besar bersama https://bom888.biz/
bintaro888 permainan paling top dan garansi imbal balik hasil besar bersama https://bintaro888.info/
askasino88 permainan paling top dan garansi imbal balik hasil besar bersama https://askasino88.org/
999aset permainan paling top dan garansi imbal balik hasil besar bersama https://999aset.com/
afb77 permainan paling top dan garansi imbal balik hasil besar bersama https://afb77.biz/
aset99 permainan paling top dan garansi imbal balik hasil besar bersama https://aset99.biz/
bendera77 permainan paling top dan garansi imbal balik hasil besar bersama https://bendera77.biz/
bendera888 permainan paling top dan garansi imbal balik hasil besar bersama https://bendera888.com/
coco88 permainan paling top dan garansi imbal balik hasil besar bersama https://coco88.org/
cuma77 permainan paling top dan garansi imbal balik hasil besar bersama https://cuma77.biz/
cuma88 permainan paling top dan garansi imbal balik hasil besar bersama https://cuma88.org/
dwv88 permainan paling top dan garansi imbal balik hasil besar bersama https://dwv88.org/
fafajp88 permainan paling top dan garansi imbal balik hasil besar bersama https://fafajp88.com/
gemar88 permainan paling top dan garansi imbal balik hasil besar bersama https://gemar88.biz/
gocap88 permainan paling top dan garansi imbal balik hasil besar bersama https://gocap88.info/
gocaptoto permainan paling top dan garansi imbal balik hasil besar bersama https://gocaptoto.asia/
hakabet88 permainan paling top dan garansi imbal balik hasil besar bersama https://hakabet88.com/
hwtoto88 permainan paling top dan garansi imbal balik hasil besar bersama https://hwtoto88.org/
ina77 permainan paling top dan garansi imbal balik hasil besar bersama https://ina77.biz/
ina88 permainan paling top dan garansi imbal balik hasil besar bersama https://ina88.info/
jingga8888 permainan paling top dan garansi imbal balik hasil besar bersama https://jingga8888.com/
juragan777 permainan paling top dan garansi imbal balik hasil besar bersama https://juragan777.asia/
kastil77 permainan paling top dan garansi imbal balik hasil besar bersama https://kastil77.info/
kebo888 permainan paling top dan garansi imbal balik hasil besar bersama https://kebo888.biz/
kkwin77 permainan paling top dan garansi imbal balik hasil besar bersama https://kkwin77.com/
kokoslot88 permainan paling top dan garansi imbal balik hasil besar bersama https://kokoslot88.asia/
luckydf88 permainan paling top dan garansi imbal balik hasil besar bersama https://luckydf88.org/
microstar888 permainan paling top dan garansi imbal balik hasil besar bersama https://microstar888.biz/
monperatoto88 permainan paling top dan garansi imbal balik hasil besar bersama https://monperatoto88.com/
mpo1122 permainan paling top dan garansi imbal balik hasil besar bersama https://mpo1122.biz/
mpo122 permainan paling top dan garansi imbal balik hasil besar bersama https://mpo122.biz/
mpopelangi88 permainan paling top dan garansi imbal balik hasil besar bersama https://mpopelangi88.com/
pamanslot88 permainan paling top dan garansi imbal balik hasil besar bersama https://pamanslot88.biz/
panel88 permainan paling top dan garansi imbal balik hasil besar bersama https://panel88.org/
paragon77 permainan paling top dan garansi imbal balik hasil besar bersama https://paragon77.biz/
paragon888 permainan paling top dan garansi imbal balik hasil besar bersama https://paragon888.info/
pion77 permainan paling top dan garansi imbal balik hasil besar bersama https://pion77.biz/
prada88 permainan paling top dan garansi imbal balik hasil besar bersama https://prada88.asia/
prada888 permainan paling top dan garansi imbal balik hasil besar bersama https://prada888.com/
qqslot88slot permainan paling top dan garansi imbal balik hasil besar bersama https://qqslot88slot.com/
rejekibet88 permainan paling top dan garansi imbal balik hasil besar bersama https://rejekibet88.com/
rezekibet88 permainan paling top dan garansi imbal balik hasil besar bersama https://rezekibet88.org/
sensa77 permainan paling top dan garansi imbal balik hasil besar bersama https://sensa77.biz/
sensa888 permainan paling top dan garansi imbal balik hasil besar bersama https://sensa888.biz/
singajp88 permainan paling top dan garansi imbal balik hasil besar bersama https://singajp88.com/
sr77 permainan paling top dan garansi imbal balik hasil besar bersama https://sr77.org/
sr88 permainan paling top dan garansi imbal balik hasil besar bersama https://sr88.org/
surya77 permainan paling top dan garansi imbal balik hasil besar bersama https://surya77.biz/
surya88 permainan paling top dan garansi imbal balik hasil besar bersama https://surya88.asia/
tajir77 permainan paling top dan garansi imbal balik hasil besar bersama https://tajir77.info/
tajir88 permainan paling top dan garansi imbal balik hasil besar bersama https://tajir88.biz/
toto122 permainan paling top dan garansi imbal balik hasil besar bersama https://toto122.com/
toto123 permainan paling top dan garansi imbal balik hasil besar bersama https://toto123.biz/
uangvip88 permainan paling top dan garansi imbal balik hasil besar bersama https://uangvip88.com/
wajik77 permainan paling top dan garansi imbal balik hasil besar bersama https://wajik77.asia/
777neko permainan paling top dan garansi imbal balik hasil besar bersama https://777neko.org/
88judi permainan paling top dan garansi imbal balik hasil besar bersama https://88judi.net/
99judi permainan paling top dan garansi imbal balik hasil besar bersama https://99judi.org/
abcslot88 permainan paling top dan garansi imbal balik hasil besar bersama https://abcslot88.asia/
slot demo gacor permainan paling top dan garansi imbal balik hasil besar bersama https://kdwapp.com/
akun demo slot gacor permainan paling top dan garansi imbal balik hasil besar bersama https://kdwapp.com/
akun slot demo gacor permainan paling top dan garansi imbal balik hasil besar bersama https://kdwapp.com/
akun demo slot pragmatic permainan paling top dan garansi imbal balik hasil besar bersama https://kdwapp.com/
akun slot demo pragmatic permainan paling top dan garansi imbal balik hasil besar bersama https://kdwapp.com/
akun slot demo permainan paling top dan garansi imbal balik hasil besar bersama https://kdwapp.com/
akun demo slot permainan paling top dan garansi imbal balik hasil besar bersama https://kdwapp.com/
slot demo gacor
akun demo slot gacor
akun slot demo gacor
akun demo slot pragmatic
akun slot demo pragmatic
akun slot demo
akun demo slot
slot demo gacor permainan paling top dan garansi imbal balik hasil besar bersama https://jebswagstore.com
akun demo slot gacor permainan paling top dan garansi imbal balik hasil besar bersama https://jebswagstore.com
akun slot demo gacor permainan paling top dan garansi imbal balik hasil besar bersama https://jebswagstore.com
akun demo slot pragmatic permainan paling top dan garansi imbal balik hasil besar bersama https://jebswagstore.com
akun slot demo pragmatic permainan paling top dan garansi imbal balik hasil besar bersama https://jebswagstore.com
akun slot demo permainan paling top dan garansi imbal balik hasil besar bersama https://jebswagstore.com
akun demo slot permainan paling top dan garansi imbal balik hasil besar bersama https://jebswagstore.com
slot demo gacor
akun demo slot gacor
akun slot demo gacor
akun demo slot pragmatic
akun slot demo pragmatic
akun slot demo
akun demo slot
slot demo gacor permainan paling top dan garansi imbal balik hasil besar bersama https://demoslotgacor.pro
akun demo slot gacor permainan paling top dan garansi imbal balik hasil besar bersama https://demoslotgacor.pro
akun slot demo gacor permainan paling top dan garansi imbal balik hasil besar bersama https://demoslotgacor.pro
akun demo slot pragmatic permainan paling top dan garansi imbal balik hasil besar bersama https://demoslotgacor.pro
akun slot demo pragmatic permainan paling top dan garansi imbal balik hasil besar bersama https://demoslotgacor.pro
akun slot demo permainan paling top dan garansi imbal balik hasil besar bersama https://demoslotgacor.pro
akun demo slot permainan paling top dan garansi imbal balik hasil besar bersama https://demoslotgacor.pro
slot demo gacor
akun demo slot gacor
akun slot demo gacor
akun demo slot pragmatic
akun slot demo pragmatic
akun slot demo
akun demo slot
slot demo gacor permainan paling top dan garansi imbal balik hasil besar bersama https://situsslotterbaru.net
akun demo slot gacor permainan paling top dan garansi imbal balik hasil besar bersama https://situsslotterbaru.net
akun slot demo gacor permainan paling top dan garansi imbal balik hasil besar bersama https://situsslotterbaru.net
akun demo slot pragmatic permainan paling top dan garansi imbal balik hasil besar bersama https://situsslotterbaru.net
akun slot demo pragmatic permainan paling top dan garansi imbal balik hasil besar bersama https://situsslotterbaru.net
akun slot demo permainan paling top dan garansi imbal balik hasil besar bersama https://situsslotterbaru.net
akun demo slot permainan paling top dan garansi imbal balik hasil besar bersama https://situsslotterbaru.net
slot demo gacor
akun demo slot gacor
akun slot demo gacor
akun demo slot pragmatic
akun slot demo pragmatic
akun slot demo
akun demo slot
situs slot terbaru
slot terbaru
