- Cocospy and Spyic were found to be leaking sensitive information
- The developers are not responding and the bugs have not been fixed
- People’s photos, messages, call logs, and more, are at risk
Email addresses, text messages, call logs, photographs, and other sensitive data, belonging to millions of people may have been exposed online thanks to a pair of faulty spyware applications.
Spyware apps, often also called “spouseware”, are apps that people covertly install on mobile devices belonging to their partners, children, or similar. They are advertised as legitimate monitoring apps, but are essentially operating in the grey zone and are not allowed on major app stores, such as the App Store or Play Store.
A cybersecurity researcher recently analyzed Cocospy and Spyic, two popular spyware apps whose code apparently has significant overlaps which allowed the researcher to pull sensitive information from their servers.
Email addresses and more
TechCrunch, which first reported on the findings, said the bug was “relatively simple to exploit”, but in order to protect the victims, decided not to share any details at this time.
When a person wants to install the spyware on someone else’s device, they first need to use an email address to register an account.
The researcher managed to exfiltrate 1.81 million of email addresses used to register with Cocospy, and roughly 880,000 addresses used for Spyic. Besides email addresses, the researcher managed to access most of the data harvested by the apps, including pictures, messages, and call logs.
Due to the nature of the apps, the developers try their best to remain hidden and out of reach. TechCrunch deduced that the developers are most likely of Chinese origin, but could not say for certain – although there is some evidence that the developer might be 711.icu, whose website isn’t even loading.
The operators did not respond to media inquiries and have not, at press time, addressed the vulnerabilities.
Leave a comment