Archive — US — techcrunch
A new security flaw in TheTruthSpy phone spyware is putting victims at risk
A critical security flaw in TheTruthSpy phone spyware enables unauthorized users to take over accounts and access sensitive data. Discovered by independent researcher Swarang Wade, this vulnerability raises concerns over the security practices of stalkerware developers, threatening victims unaware their data is compromised. TheTruthSpy has a history of security breaches, with over 400,000 victims impacted over the years.
Key points
- Swarang Wade discovered a security vulnerability in TheTruthSpy and its companion apps allowing account takeover.
- Vulnerability allows anyone to reset passwords, hijacking any user account without consent.
- TheTruthSpy has a history of security issues, with at least four significant breaches noted.
- Director of TheTruthSpy, Van Thieu, claimed to have lost the source code, preventing a fix.
- Previous breaches exposed personal data of over 400,000 victims, including messages and location data.
- TheTruthSpy is rebranding to PhoneParental while maintaining its underlying risky technology.
Why it matters
- The incident highlights ongoing concerns about the security of stalkerware and spyware apps.
- This aligns with a historical trend where digital privacy violations have escalated, especially in surveillance technologies.
- As of 2025, the rise in privacy awareness and regulations may impact the operational methods of stalkerware producers.
TheTruthSpy's critical vulnerability underscores the dangers posed by stalkerware, emphasizing ongoing privacy issues and the urgent need for stronger regulations in the tech industry to protect vulnerable individuals.