- Cocospy and Spyic were found to be leaking sensitive information
- The developers are not responding and the bugs have not been fixed
- People’s photos, messages, call logs, and more, are at risk
Email addresses, text messages, call logs, photographs, and other sensitive data, belonging to millions of people may have been exposed online thanks to a pair of faulty spyware applications.
Spyware apps, often also called “spouseware”, are apps that people covertly install on mobile devices belonging to their partners, children, or similar. They are advertised as legitimate monitoring apps, but are essentially operating in the grey zone and are not allowed on major app stores, such as the App Store or Play Store.
A cybersecurity researcher recently analyzed Cocospy and Spyic, two popular spyware apps whose code apparently has significant overlaps which allowed the researcher to pull sensitive information from their servers.
Email addresses and more
TechCrunch, which first reported on the findings, said the bug was “relatively simple to exploit”, but in order to protect the victims, decided not to share any details at this time.
When a person wants to install the spyware on someone else’s device, they first need to use an email address to register an account.
The researcher managed to exfiltrate 1.81 million of email addresses used to register with Cocospy, and roughly 880,000 addresses used for Spyic. Besides email addresses, the researcher managed to access most of the data harvested by the apps, including pictures, messages, and call logs.
Due to the nature of the apps, the developers try their best to remain hidden and out of reach. TechCrunch deduced that the developers are most likely of Chinese origin, but could not say for certain – although there is some evidence that the developer might be 711.icu, whose website isn’t even loading.
The operators did not respond to media inquiries and have not, at press time, addressed the vulnerabilities.
You might also like
- Two notorious stalkerware apps appear to finally have been taken offline following court ruling
- We’ve rounded up the best password managers
- Take a look at our guide to the best authenticator app
You must confirm your public display name before commenting
Please logout and then login again, you will then be prompted to enter your display name.
Australia’s largest pension funds hit by hackers, thousands of dollars stolen
Businesses are losing millions to fraud every year
iOS 18.4 has broken CarPlay for some iPhone users – and it’s hitting multiple carmakers
-
1Why is Nintendo Switch 2 so expensive? Analysts think the price of the console isn’t the problem as software becomes a ‘much harder sell’
-
2Google Messages is finally going to get better at handling your lengthy texts
-
3New sneak peek at James Gunn’s Superman movie reveals a jaw-dropping first look at the Fortress of Solitude – and it’s hiding two big cast secrets in plain sight
-
4Microsoft could make a huge change to an iconic part of Windows 11 that you use every day, and I can’t wait to try the new Start menu
-
5The Samsung Galaxy S25 Edge’s new release date could be May 13
