The Stalkers in Our Pockets

Consider this: if someone was always watching what you did on your devices, would you change how you use them? Would you send the same messages, take the same pictures, search for the same things? It’s chilling to think that, beyond the everyday data mining corporations subject us to, there might be a single person invested in capturing everything you do on your devices. For many people, this isn’t just a thought experiment, it’s a disturbing reality – though they likely don’t even know it.

Meet stalkerware, a dangerous and irresponsible form of spyware. Spyware is a software that gathers data from a user’s device and sends it back to a third party, essentially allowing them to monitor the device. Stalkerware, however, refers to consumer-grade spyware that is misused to spy on unknowing individuals, usually domestic partners. Using spyware this way is generally illegal, and there is unfortunately no shortage of companies selling spyware that can be used in this way.

Stalkerware’s Impact

Stalkerware is an effective tool for abusive partners, as it allows them to monitor and control their victims more completely. Usually, the abuser finds a way to access their partner’s phone, installing spyware that may let them see their victim’s phone’s location, calls, text messages, emails, photos, videos, and online activity. Some stalkerware apps even allow the abuser to use the victim’s on-phone microphone and camera to see and hear what’s going on around them. The abuser’s partner is generally none the wiser that they are being monitored like this, as a feature of stalkerware apps is that they’re not easy to spot.

What’s worse, the companies that sell stalkerware have been known to specifically promote their product for use in monitoring domestic partners, so they are often entirely complicit in this deplorable activity. This is damning enough for the stalkerware industry as a whole, but there is unfortunately more to the story: stalkerware companies are notoriously irresponsible with data collected from victims.

In July, the technology news website published the article “Hacked, leaked, exposed: Why you should never use stalkerware apps”, which contained a list of a staggering 26 different companies that have experienced data breaches since 2017, some of which had experienced multiple data breaches since then. In fact, in the two months since this article was published, another critical security flaw was discovered in stalkerware made by TheTruthSpy, a company that has been hacked or breached at least three times since 2017. It doesn’t look like the newly discovered flaw will be patched anytime soon either, as the spyware operation’s director claimed to TechCrunch that the source code was lost, meaning he can’t fix the bug.

That show of incompetence isn’t anything new to stalkerware companies either, as a good portion of the data breaches since 2017 didn’t even require a third-party to expose the data they stored. Instead, according to the TechCrunch report, at least twelve companies have allowed user data to leak onto the internet through careless handling rather than hackers exploiting a bug in their code.

Though the secrecy inherent in this industry makes exact numbers difficult to pin down, reports of these data breaches indicate that hundreds of thousands of stalkerware victims have had their data exposed to the internet since 2017 due to apps they didn’t even know were on their devices. Since these stalkerware companies value secrecy, these victims are rarely, if ever, alerted to the fact that their data has been leaked.

Spyware’s Legality

Spyware in general falls into a legal gray area, as there are cases in which it is arguably an important tool. For example, commercial spyware is often used by law enforcement agencies in criminal investigations, such as Immigrations and Customs Enforcement’s (ICE) current use of Paragon spyware in their controversial deportation campaign. Beyond governmental uses is where things get dicey. Federal legislation is lacking concerning parents’ rights to monitor their children for example, or for bosses to monitor their employees on company devices. State and local laws vary considerably in both those areas. What we do have at the federal level is the Stored Communications Act, under which it’s generally illegal to access someone’s electronic communications without their consent.

That means it’s reasonable to say that the use of stalkerware, which explicitly allows users to monitor their target’s communications without consent, is illegal. Two stalkerware makers, PhoneSpector and Highster, were even shut down after they were accused of encouraging the use of their product for illegal surveillance. But there are dozens of stalkerware companies, so taking down two of them is hardly making a dent in the industry.

Going after all these companies on the legal battlefield is easier said than done, as most of the time these companies market their software as a way for parents to monitor their children or employers to monitor their employees, falling into that legal gray area. Even if one of them is taken down after marketing their software for use against partners, they can often just rebrand themselves and come back under a different name.

What to Do

Thankfully, there is evidence that stalkerware usage has decreased dramatically in the past few years, based on a report from Malwarebytes Labs. Though, a report from the cybersecurity company Kaspersky still found over 30,000 unique individuals were affected by stalkerware in 2023, so the problem is far from gone. But the good news continues, because Apple recently came out with a feature for the iPhone 17: Memory Integrity Enforcement. They claim this feature will help stop memory corruption bugs, which are some of the most common vulnerabilities that spyware exploits. As this technology develops, stalkerware will likely have a much harder time getting on a device.

If you’re concerned that your phone or other device may be infected with stalkerware, it can be difficult to check without knowing the specific software being used, since these apps are designed to be hidden. General signs your device has been infected with stalkerware can include your abuser knowing lots of very specific information about you (such as exact location and what you’ve texted to other people), this abuser having physical access to your phone, your phone’s battery draining faster than usual, an unexplained increase in your data usage, and unexplained changes to your phone’s settings. The Safety Net Project provides some good resources here that can help you identify and deal with stalkerware on your devices.

But be careful, because if stalkerware is on your device, it means that whoever put it there will be able to see what you’re doing and will be alerted if the stalkerware is removed. Be safe, and if you or a loved one are in an abusive situation, consider calling the National Domestic Abuse Hotline (1-800-799-7233) where help is available 24/7. Always call 911 first in emergency situations.

At Crimson Vista, we offer “novel technologies” as well as services that can improve your cyber safety and threat hunting capabilities. For instance, our SecurityHub service offers opportunities to train, guide, and even augment your cybersecurity team to better handle advanced cybersecurity issues, including ones related to spyware.

Sources

1. Hacked, leaked, exposed: Why you should stop using stalkerware apps
2. Spyware Laws
3. Here’s the tech powering ICE’s deportation crackdown
4. Legal and Policy Responses to Spyware: A Primer
5. What is Spyware?
6. TechCrunch Reference Guide to Security Terminology: Stalkerware
7. Tech Safety - Spyware
8. A new security flaw in TheTruthSpy phone spyware is putting victims at risk
9. Stalkerware activity drops, but glaring problem with spying revealed
10. Global Kaspersky report reveals digital violence has increased
11. Apple’s latest iPhone security feature just made life more difficult for spyware makers
12. Stalkerware: What to Know