Archive — US — techcrunch
Data breach reveals Catwatchful ‘stalkerware’ is spying on thousands of phones
A security flaw in the Catwatchful spyware, designed for non-consensual surveillance, exposed data of over 62,000 customers, including administrator information. The breach revealed email addresses, plaintext passwords, and sensitive phone data from 26,000 victims, mostly in Latin America. Despite operating illegally, the spyware uses Google’s servers, highlighting ongoing vulnerabilities in consumer-grade surveillance tech.
Key points
- Catwatchful is a stealthy Android spyware targeted at unsuspecting smartphone users.
- A security vulnerability, discovered by Eric Daigle, exposed the entire database of customer data.
- Data breach involved 62,000 customers and information about 26,000 victims' devices.
- The spyware's administrator, Omar Soca Charcov, was identified due to poor operational security.
- The app uses Google Firebase, which raises questions about surveillance apps using major tech platforms.
- Many affected devices were located in Latin American countries.
- TechCrunch provided information to Google; they began investigating and enhancing security through Google Play Protect.
Why it matters
- The incident reflects a significant trend in 2025 towards increasing concerns about data privacy and security in the tech industry.
- It aligns with a growing awareness and legislative push against stalkerware and invasive tracking technology.
- The proliferation of surveillance apps represents ongoing challenges in regulating digital surveillance, especially as remote work and personal devices intertwine.
The Catwatchful breach underscores the urgent need for enhanced security measures against stalkerware, raising alarms about privacy in an increasingly digital world. Awareness and regulatory frameworks must evolve to protect individuals from non-consensual surveillance.