Security flaw in popular stalkerware apps is exposing phone data of millions


- Cocospy and Spyic were found to be leaking sensitive information
- The developers are not responding and the bugs have not been fixed
- People’s photos, messages, call logs, and more, are at risk
Email addresses, text messages, call logs, photographs, and other sensitive data, belonging to millions of people may have been exposed online thanks to a pair of faulty spyware applications.
Spyware apps, often also called “spouseware”, are apps that people covertly install on mobile devices belonging to their partners, children, or similar. They are advertised as legitimate monitoring apps, but are essentially operating in the grey zone and are not allowed on major app stores, such as the App Store or Play Store.
A cybersecurity researcher recently analyzed Cocospy and Spyic, two popular spyware apps whose code apparently has significant overlaps which allowed the researcher to pull sensitive information from their servers.
Email addresses and more
TechCrunch, which first reported on the findings, said the bug was “relatively simple to exploit”, but in order to protect the victims, decided not to share any details at this time.
When a person wants to install the spyware on someone else’s device, they first need to use an email address to register an account.
The researcher managed to exfiltrate 1.81 million of email addresses used to register with Cocospy, and roughly 880,000 addresses used for Spyic. Besides email addresses, the researcher managed to access most of the data harvested by the apps, including pictures, messages, and call logs.
Due to the nature of the apps, the developers try their best to remain hidden and out of reach. TechCrunch deduced that the developers are most likely of Chinese origin, but could not say for certain – although there is some evidence that the developer might be 711.icu, whose website isn’t even loading.
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
The operators did not respond to media inquiries and have not, at press time, addressed the vulnerabilities.
You might also like
Cocospy and Spyic were found to be leaking sensitive information The developers are not responding and the bugs have not been fixed People’s photos, messages, call logs, and more, are at risk Email addresses, text messages, call logs, photographs, and other sensitive data, belonging to millions of people may have…
Recent Posts
- 3 features that would actually make me pay for a Samsung Health subscription for my Galaxy Watch – and one big problem it needs to avoid
- TikTok’s ‘ban’ problem could end soon with a new app and a sale
- 16-Core AMD EPYC 4005 CPU is almost 3X faster than AMD’s first server flagship – and I can’t believe what a bargain that is
- Samsung’s very special rugged tablet comes with eight – yes, eight – years of Android updates and hot-swappable batteries
- The latest Samsung Galaxy Z Flip 7 leak is the first hands-on video of the flip foldable
Archives
- July 2025
- June 2025
- May 2025
- April 2025
- March 2025
- February 2025
- January 2025
- December 2024
- November 2024
- October 2024
- September 2024
- August 2024
- July 2024
- June 2024
- May 2024
- April 2024
- March 2024
- February 2024
- January 2024
- December 2023
- November 2023
- October 2023
- September 2023
- August 2023
- July 2023
- June 2023
- May 2023
- April 2023
- March 2023
- February 2023
- January 2023
- December 2022
- November 2022
- October 2022
- September 2022
- August 2022
- July 2022