Loading story…
Kaspersky reported 32,694 unique mobile users affected by stalkerware in 2021, a 39% decline from 2020 and the lowest level it has recorded since tracking began in 2018. The company said the drop should not be read as a reduction in abuse, describing stalkerware as a tool of tech-enabled intimate partner violence and warning that the real number of victims is likely much higher than telemetry shows. The most affected countries were Russia, Brazil, the United States, and India, while Cerberus and Reptilicus were the most commonly detected stalkerware families.
The report said perpetrators may have shifted from traditional stalkerware apps to other monitoring methods during pandemic conditions, including broader use of IoT devices and alternative surveillance techniques. It also pointed to a wider response from governments and advocacy groups, citing legal and institutional actions in Japan, the United States, Germany, and Europe, along with support efforts such as the Coalition Against Stalkerware and Kaspersky’s TinyCheck tool for victims and frontline responders.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
In Kaspersky's 2021 data, Cerberus was the most used stalkerware application, affecting 5,575 users globally, followed by Reptilicus/Vkurse with 4,417 users. Other prominent apps included Track My Phones, AndroidLost, MobileTracker Free, Hoverwatch, and wSpy.
Kaspersky reported 32,694 unique mobile users affected by stalkerware globally in 2021, a 39% decrease from 2020 and the lowest level in its dataset since tracking began. The company detected affected users in 185 countries or territories, with Russia, Brazil, the United States, and India ranking highest.
Kaspersky said 2021 was the lowest level it had recorded since it began gathering stalkerware data in 2018, establishing 2018 as the start of its tracking period.
Kaspersky commissioned a global survey in November 2021 with more than 21,000 participants in 21 countries about privacy and digital stalking in intimate relationships. The survey found 30% considered monitoring a partner without consent acceptable in some circumstances, and 15% said a partner had required them to install a monitoring app.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET Research reported **158 security and privacy flaws** across **58 of 86** analyzed Android stalkerware applications from 86 vendors, warning that the weaknesses could expose both victims and operators to compromise. According to the report, the issues could allow third parties to intercept stolen data, hijack stalker accounts, fabricate uploaded evidence, remotely control monitored devices, and in some cases achieve **remote code execution**. ESET also said telemetry showed stalkerware use was increasing, with many products presenting themselves as child- or employee-monitoring tools while remaining hidden from victims. The most common problems included transmission of sensitive data over insecure **HTTP**, storage of sensitive files on external media, unauthenticated exposure of victim or operator data from backend servers, and weak authorization controls in mobile apps and web-based admin panels. ESET said it began coordinated disclosure under a 90-day policy on **December 19, 2020**, but only a small minority of vendors had fixed the reported issues by the time of publication, underscoring persistent risks in an ecosystem already associated with covert surveillance and abuse.
Aug 14, 2026
A hacktivist scraped and published **~500,000+ payment records** tied to consumer “stalkerware” services operated by the Ukrainian company **Struktura**, exposing customer email addresses and partial payment details. The leaked transactions include purchases for phone-tracking and monitoring brands such as **uMobix**, **Geofinder**, and **Peekviewer** (formerly *Glassagram*), and also reference transactions associated with other surveillance apps like **Xnspy**. The incident highlights ongoing security weaknesses in the commercial surveillance ecosystem, where operators’ poor security practices repeatedly expose sensitive customer—and often victim—data. Separately, mobile threat research reported a new Android malware family, **GhostChat**, distributing malicious APKs that impersonate popular chat apps (including **WhatsApp**) to intercept messages, steal credentials, and exfiltrate contacts and media by injecting code into the app process. While both stories involve mobile-user risk, the GhostChat activity is a distinct malware campaign and not directly related to the stalkerware payment-record leak; the stalkerware reporting also contextualizes the Struktura/uMobix exposure within a broader pattern of **dozens of stalkerware vendors** being hacked or leaking data since 2017, including multiple high-profile incidents in 2025 affecting victims’ messages, photos, call logs, and location data.
Jun 29, 2026
Researchers and victim-support advocates warned that cyberstalkers are exploiting **Google Chrome Sync** as a covert surveillance method, allowing abusers to monitor a victim’s browsing activity without installing malware or obtaining the victim’s Google credentials. The technique requires only brief physical access to a phone or computer: an abuser signs Chrome into a Google account they control, enables sync, and can then remotely review browsing history and potentially other synced data. Certo Software said the method can expose visits to sensitive resources such as family lawyers or domestic violence support sites, making it particularly dangerous in coercive-control and domestic abuse cases. The reported abuse affects Chrome across **Android, iPhone, Windows, and Mac**, and researchers said it is harder for victims to detect because Chrome does not provide prominent in-app warnings when a new account is added or sync is enabled. Certo said stronger mobile protections and app-store enforcement against stalkerware may be pushing abusers toward misuse of legitimate built-in features instead of traditional spyware. The company urged users to review which account is signed into Chrome, remove unknown accounts, and change important passwords if saved credentials may have been synced, while calling on Google to provide clearer and more persistent notifications around account changes and sync activation.
Jul 16, 2026