A security vulnerability in phone-monitoring apps Cocospy and Spyic is exposing personal data of millions of people, allowing access to messages, photos, call logs, and more.
The bug also reveals email addresses of users who signed up with these apps for covert monitoring of others.
The operators of Cocospy and Spyic have not addressed the issue at the time of publishing.
The bug enables unauthorized access to email addresses, with 1.81 million from Cocospy and 880,167 from Spyic exposed.
Cocospy and Spyic are among 23 surveillance operations hacked since 2017, raising concerns about data breaches and privacy violations.
Stalkerware apps like Cocospy and Spyic, designed for covert monitoring, often breach privacy laws and are associated with illegal spying activities.
The spyware apps are linked to a China-based developer, 711.icu, and often avoid public attention to mitigate legal risks.
Users can check for compromise by weakening security settings, and guidelines are provided for identifying and removing stalkerware.
Safety measures include enabling Google Play Protect for Android users and securing Apple accounts with strong passwords and two-factor authentication for iOS users.
Support resources are available for victims of domestic abuse and those concerned about spyware compromise.