Loading story…
ESET Research reported 158 security and privacy flaws across 58 of 86 analyzed Android stalkerware applications from 86 vendors, warning that the weaknesses could expose both victims and operators to compromise. According to the report, the issues could allow third parties to intercept stolen data, hijack stalker accounts, fabricate uploaded evidence, remotely control monitored devices, and in some cases achieve remote code execution. ESET also said telemetry showed stalkerware use was increasing, with many products presenting themselves as child- or employee-monitoring tools while remaining hidden from victims.
The most common problems included transmission of sensitive data over insecure HTTP, storage of sensitive files on external media, unauthenticated exposure of victim or operator data from backend servers, and weak authorization controls in mobile apps and web-based admin panels. ESET said it began coordinated disclosure under a 90-day policy on December 19, 2020, but only a small minority of vendors had fixed the reported issues by the time of publication, underscoring persistent risks in an ecosystem already associated with covert surveillance and abuse.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
ESET Research published a white paper describing its analysis of 86 Android stalkerware apps from 86 vendors and 158 security and privacy issues across 58 of them. The report said the flaws could enable interception of victim data, takeover of stalker accounts, fabricated uploads, remote control of victim devices, and possible remote code execution.
ESET started coordinated vulnerability disclosure to affected Android stalkerware vendors under a 90-day policy, making up to three notification attempts per vendor. The disclosure covered serious security and privacy flaws found across dozens of products.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A hacktivist scraped and published **~500,000+ payment records** tied to consumer “stalkerware” services operated by the Ukrainian company **Struktura**, exposing customer email addresses and partial payment details. The leaked transactions include purchases for phone-tracking and monitoring brands such as **uMobix**, **Geofinder**, and **Peekviewer** (formerly *Glassagram*), and also reference transactions associated with other surveillance apps like **Xnspy**. The incident highlights ongoing security weaknesses in the commercial surveillance ecosystem, where operators’ poor security practices repeatedly expose sensitive customer—and often victim—data. Separately, mobile threat research reported a new Android malware family, **GhostChat**, distributing malicious APKs that impersonate popular chat apps (including **WhatsApp**) to intercept messages, steal credentials, and exfiltrate contacts and media by injecting code into the app process. While both stories involve mobile-user risk, the GhostChat activity is a distinct malware campaign and not directly related to the stalkerware payment-record leak; the stalkerware reporting also contextualizes the Struktura/uMobix exposure within a broader pattern of **dozens of stalkerware vendors** being hacked or leaking data since 2017, including multiple high-profile incidents in 2025 affecting victims’ messages, photos, call logs, and location data.
Jun 29, 2026
Kaspersky reported **32,694** unique mobile users affected by stalkerware in 2021, a **39% decline** from 2020 and the lowest level it has recorded since tracking began in 2018. The company said the drop should not be read as a reduction in abuse, describing stalkerware as a tool of tech-enabled intimate partner violence and warning that the real number of victims is likely much higher than telemetry shows. The most affected countries were **Russia, Brazil, the United States, and India**, while **Cerberus** and **Reptilicus** were the most commonly detected stalkerware families. The report said perpetrators may have shifted from traditional stalkerware apps to other monitoring methods during pandemic conditions, including broader use of **IoT devices** and alternative surveillance techniques. It also pointed to a wider response from governments and advocacy groups, citing legal and institutional actions in **Japan, the United States, Germany, and Europe**, along with support efforts such as the **Coalition Against Stalkerware** and Kaspersky’s **TinyCheck** tool for victims and frontline responders.
Aug 15, 2026
A new Android banking malware named **Sturnus** has been identified by security researchers, exploiting Android’s accessibility features to stealthily monitor user activity, intercept chats, and recreate fake banking app interfaces to steal sensitive financial data. The malware is distributed via malicious APK files outside the Google Play Store and can prevent its own uninstallation, raising the risk for users who sideload apps. Google has stated that no apps containing Sturnus have been found on the Play Store and that Google Play Protect provides automatic protection against known variants, but users are still advised to exercise caution when installing apps from untrusted sources. More broadly, spyware remains a significant threat to mobile device users, with various forms capable of tracking, recording, and stealing data from both iOS and Android phones. Spyware can be disguised as legitimate applications or delivered through phishing, and may include nuisanceware that focuses on ad revenue or more dangerous variants like stalkerware. Users are encouraged to watch for unusual device behavior, unknown apps, or data spikes, and to use antivirus tools, keep devices updated, and avoid untrusted app sources to mitigate these risks.
Jun 29, 2026