Loading story…
A hacktivist scraped and published ~500,000+ payment records tied to consumer “stalkerware” services operated by the Ukrainian company Struktura, exposing customer email addresses and partial payment details. The leaked transactions include purchases for phone-tracking and monitoring brands such as uMobix, Geofinder, and Peekviewer (formerly Glassagram), and also reference transactions associated with other surveillance apps like Xnspy. The incident highlights ongoing security weaknesses in the commercial surveillance ecosystem, where operators’ poor security practices repeatedly expose sensitive customer—and often victim—data.
Separately, mobile threat research reported a new Android malware family, GhostChat, distributing malicious APKs that impersonate popular chat apps (including WhatsApp) to intercept messages, steal credentials, and exfiltrate contacts and media by injecting code into the app process. While both stories involve mobile-user risk, the GhostChat activity is a distinct malware campaign and not directly related to the stalkerware payment-record leak; the stalkerware reporting also contextualizes the Struktura/uMobix exposure within a broader pattern of dozens of stalkerware vendors being hacked or leaking data since 2017, including multiple high-profile incidents in 2025 affecting victims’ messages, photos, call logs, and location data.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
TechCrunch reviewed the leaked dataset, verified sample records through password-reset flows and unauthenticated invoice lookups, and reported that internal references pointed to Struktura rather than only Ersten Group. Neither the companies nor Struktura CEO Viktoriia Zosim responded to requests for comment.
After obtaining the records, the hacktivist published the dataset on a known hacking forum. The post identified the vendor as Ersten Group, while reporting later found multiple indicators linking the operation to the Ukrainian company Struktura.
A hacktivist using the alias "wikkid" exploited a trivial website bug to scrape more than 500,000 payment records from a stalkerware vendor. The exposed data included customer email addresses, app purchase details, card type information, and the last four digits of payment cards for services including Geofinder, uMobix, Peekviewer, and Xnspy.
In 2022, Xnspy was associated with a major data exposure that revealed private data from tens of thousands of Android and iPhone devices. This earlier incident is referenced because records tied to Xnspy also appeared in the newly leaked payment dataset.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcedatabreaches.net
Open sourcetechcrunch.com
Open sourcetechcrunch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET Research reported **158 security and privacy flaws** across **58 of 86** analyzed Android stalkerware applications from 86 vendors, warning that the weaknesses could expose both victims and operators to compromise. According to the report, the issues could allow third parties to intercept stolen data, hijack stalker accounts, fabricate uploaded evidence, remotely control monitored devices, and in some cases achieve **remote code execution**. ESET also said telemetry showed stalkerware use was increasing, with many products presenting themselves as child- or employee-monitoring tools while remaining hidden from victims. The most common problems included transmission of sensitive data over insecure **HTTP**, storage of sensitive files on external media, unauthenticated exposure of victim or operator data from backend servers, and weak authorization controls in mobile apps and web-based admin panels. ESET said it began coordinated disclosure under a 90-day policy on **December 19, 2020**, but only a small minority of vendors had fixed the reported issues by the time of publication, underscoring persistent risks in an ecosystem already associated with covert surveillance and abuse.
Aug 14, 2026
Researchers detailed the discovery of **Geost**, a previously unknown Android banking botnet that targeted users in Russia and harvested SMS messages, banking data, and other sensitive information from infected devices. Analysis indicated the operation relied on at least **13 command-and-control servers**, more than **140 domains**, and over **150 Android APKs**, with one observed server alone suggesting a conservative victim count of roughly **871,200 devices**. The malware monitored account balances and appeared to target several major Russian banks and payment services, placing it among the more significant mobile banking threats documented in the region. The botnet was uncovered after multiple operational security mistakes by its operators exposed internal activity and infrastructure. Investigators found Geost administrators using the **HtBot** illegal proxy network, sending unencrypted C2 traffic, reusing infrastructure, and maintaining poorly secured developer communications that leaked credentials and Skype chat logs. Those errors allowed researchers to map relationships between aliases, infrastructure, and probable members of the underground group behind the malware, while broader reporting on Android banking malware such as **Asacub** underscored the continuing rise of mobile banker campaigns aimed at financial theft.
Aug 15, 2026
Researchers have identified **KidsProtect**, an Android surveillance tool marketed online as a parental monitoring app but analyzed as full-featured stalkerware and a remote access trojan. Certo reported the malware is being sold openly on a clear-web hacking forum with subscriptions starting around **$60**, and said the operator appears to be Greek-speaking based on forum and app artifacts. The spyware can covertly record calls, stream microphone audio, track GPS location, intercept SMS messages and notifications, log keystrokes, access the camera, and view the victim’s screen while hiding behind benign labels such as **"WiFi Service"**. Analysis found KidsProtect abuses Android **Accessibility Service**, requests broad permissions, persists across reboots through `BootReceiver`, and resists removal by registering as a **Device Administrator**. Researchers said installation guidance includes disabling **Google Play Protect**, and identified the package name `com.example.parentguard` as an indicator of compromise. The most significant finding is a **white-label reseller model** that allows buyers to rebrand and resell the spyware under their own names, a tactic that could frustrate attribution and weaken the impact of enforcement actions that previously disrupted stalkerware operations such as **PhoneSpector**, **Highster Mobile**, and **TheTruthSpy**.
Jun 29, 2026