Catwatchful Spyware Breached Revealing Thousands of Records

A cybersecurity researcher has uncovered a major breach in the Android spyware app “Catwatchful”, exposing around 62,000 customers, including the app administrator, according to a July 2 blog post.

The exposed database revealed at least 26,000 victims of the operation, with the total number potentially being higher.

The researcher, Eric Daigle, discovered and exploited a vulnerability in the app, which falls into a category known as consumer-grade spyware, also referred to as stalkerware. These apps are often marketed for tracking spouses or partners and operate by secretly harvesting data from a victim’s phone without their knowledge.

Though stalkerware apps exist on a legal gray market, monitoring someone else’s data without their explicit consent is illegal worldwide.

According to Daigle, the app stands out among other stalkerware apps for its functionality. “The app works really well. A lot of stalkerware apps are half-broken, clearly built by gluing together various chunks of spaghetti code long abandoned by their original authors. Not so here – all these features work as advertised with minimal latency,” Daigle writes in his blog post.

Daigle goes on to explain that Catwatchful offers “particularly creepy” features such as live access to a device’s camera and microphone, allowing the user to take photos, videos, and audio recordings without alerting the victim in any way.

Stalkerware apps are often as dangerous for their customers as they are for the people they’re used on. This year has seen several high-profile cases of breaches into stalkerware apps that exposed key customer data. In March, a breach into two of the biggest stalkerware apps on the market, Cocospy and Spyic, exposed the information of millions of customers and victims alike.

According to tech news site TechCrunch, most of the compromised devices were located in Mexico, Colombia, India, Peru, Argentina, Ecuador, and Bolivia (in order of the number of victims), with records going as far back as 2018.

The leaked database also revealed the identity of the operation’s administrator, Uruguay-based developer Omar Soca Charcov. A copy of the compromised database has been shared with Have I Been Pwned, allowing individuals to check whether their personal information was included in the leak.

Spyware has also been used on a government-wide level to spy on political dissidents, journalists, and activists. Recently, the Citizen Lab research group confirmed the use of Paragon spyware on European journalists.