60,000 Phones Infected with Spyhide Stalkerware

Recent research has uncovered unsettling data that exposes a clandestine phone surveillance application, Spyhide, actively gathering confidential data from a multitude of Android devices globally.

Spyhide is an insidious form of stalkerware, or spouseware, typically installed on a target’s device by someone privy to their passcode. The app is skillfully concealed on the device’s home screen, making detection and removal exceedingly difficult. Once installed, Spyhide surreptitiously and continuously harvests data including contacts, messages, photos, call logs and recordings, and real-time precise location.

Despite their cunning tactics and extensive access to a victim’s phone data, these stalkerware apps have a notorious reputation for being prone to glitches. They can inadvertently expose, leak or further compromise the stolen private data, amplifying the potential risks posed by such phone surveillance apps. Currently, Spyhide has joined the ranks of such malicious operations.

A Switzerland-based hacker, Maia arson crimew, shared in a blog post that they exposed a part of the spyware’s development environment. This allowed them access to the source code of the web dashboard that abusers use to peruse the stolen data from their victims. Exploiting a flaw in the dashboard’s poorly written code, crimew was able to access back-end databases, revealing the covert spyware operation and its probable administrators.

Crimew submitted a text-only copy of Spyhide’s database to TechCrunch for verification and scrutiny.

Detailed records from about 60,000 compromised Android devices, ranging from 2016 to mid-July this year, were stored in Spyhide’s database. These records comprise call logs, text messages, and precise location histories stretching back years. Furthermore, it also includes information on each file, such as timestamps for photos or videos and durations of recorded calls.

TechCrunch processed almost two million location data points using offline mapping software to visualize and comprehend the global extent of the spyware.

The findings revealed that Spyhide’s surveillance network envelops every continent, with significant victim concentrations in Europe and Brazil. There are more than 3,100 breached devices in the U.S., a mere fraction of the total number worldwide, yet these victims are among the most heavily surveilled based on the volume of location data alone. In one instance, a U.S. device infected by Spyhide silently uploaded more than 100,000 location data points.