Stalkerware platforms Cocospy and Spyic leak the data of millions of people
Take action: Check your phone from time to time, you may have spyware on it. And know that the vendors of these products are far from competent in securing their own application.
Learn More
Two stalkerware applications, Cocospy and Spyic, are exposing sensitive data of millions of individuals whose phones are spied on due to a security vulnerability of the platforms. The applications share similar source code and have launched in 2018 and 2019 respectively, are designed to operate covertly on victims' devices while continuously uploading device data to a monitoring dashboard.
Installation of these applications typically require physical access to Android devices for installation or Apple account credentials for iOS devices. They are marketed as parental control or employee monitoring solutions but are often used for illegal surveillance of romantic partners or spouses.
Cocospy has exposed the data of 1.81 million people, and Spyic has exposed the data of 880,167 people.
The exposed data includes:
- Personal messages
- Photos
- Call logs
- Email addresses of stalkerware operators/customers
- Device location data
- iCloud data (for iOS devices)
- Various other personal data exfiltrated from compromised devices
The vulnerability is relatively simple to exploit but remains unfixed at the time of reporting. The operators of both applications have not responded to requests for comment. Technical analysis revealed that the apps masquerade as "System Service" applications on Android devices and utilize Cloudflare for data transmission, with some victim data being stored on Amazon Web Services servers. Evidence suggests a connection to a China-based mobile app developer identified as 711.icu.
To check whether your device has such spyware:
- On Android devices, enter ✱✱001✱✱ on the phone keypad and pressing "call" can reveal the hidden apps
- Check installed apps through Android Settings menu
- For iOS users, review connected devices and implement two-factor authentication
The breach data has been added to Have I Been Pwned's database, marked as "sensitive," allowing only affected individuals to verify if their email addresses were compromised.
