Приложение для «родительского контроля» оказалось инструментом скрытого слежения. Создатели уверяют, что это для безопасности детей, но упор на невидимость для пользователя выглядит подозрительно. База с логинами и паролями администраторов уже гуляет по даркнету. Кибербезопасники бьют тревогу — данные могут использовать для шантажа или взломов. Как всегда, советуем сменить пароли и проверить настройки приватности! 🔒🔍
stalker cat Provider of covert surveillance app spills passwords for 62,000 users Creators say app is intended for parental monitoring. So why the emphasis on stealth? Dan Goodin – Jul 3, 2025 3:36 pm | 28 Credit:
Getty Images | kontekbrothersCredit:
Getty Images | kontekbrothersText settings Story text Size Small Standard Large Width
- Standard Wide Links Standard Orange
- Subscribers only Learn more Minimize to nav The maker of a phone app that is advertised as providing a stealthy means for monitoring all activities on an Android device spilled email addresses, plain-text passwords, and other sensitive data belonging to 62,000 users, a researcher discovered recently. A security flaw in the app, branded Catwatchful, allowed researcher Eric Daigle to download a trove of sensitive data , which belonged to account holders who used the covert app to monitor phones. The leak, made possible by a SQL injection vulnerability, allowed anyone who exploited it to access the accounts and all data stored in them. Unstoppable Catwatchful creators emphasize the app’s stealth and security. While the promoters claim the app is legal and intended for parents monitoring their children’s online activities, the emphasis on stealth has raised concerns that it’s being aimed at people with other agendas. «Catwatchful is invisible,» a page promoting the app says. «It cannot be detected. It cannot be uninstalled. It cannot be stopped. It cannot be closed. Only you can access the information it collects.» The promoters go on to say users «can monitor a phone without [owners] knowing with mobile phone monitoring software. The app is invisible and undetectable on the phone. It works in a hidden and stealth mode.» Daigle said the app does indeed stay hidden on devices as it uploads content in real time that can then be viewed from a web dashboard. The app, however, has a hidden backdoor that allows it to be uninstalled when a user inputs the numbers 543210 into the phone app keyboard, TechCrunch reported Wednesday. Daigel said other data spilled in the dump allowed him to identify the app operators and some of the online services they rely on. «Dumping a stalkerware service’s database lets you do lots of fun things like identify who runs it and report it to various cloud providers who claim they’ll take it down,» the researcher wrote. TechCrunch said that a web service hosting the app infrastructure terminated service after being contacted by the publication. Then, TechCrunch said, web host HostGator started hosting the infrastructure. Representatives of HostGator didn’t immediately respond to questions about whether Catwatchful violates any of the host’s terms of service. Google has added new protections for Google Play Protect, its security tool for detecting malicious apps on Android phones, TechCrunch said. The protections will detect the Catwatchful spyware or its installer on a user’s phone. Dan Goodin Senior Security Editor Dan Goodin Senior Security Editor Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. In his spare time, he enjoys gardening, cooking, and following the independent music scene. Dan is based in San Francisco. Follow him at here on Mastodon and here on Bluesky. Contact him on Signal at DanArs.82. 28 Comments
