Thousands of Android devices have been sending real-time information about contacts, messages, photos, call logs and recordings, and granular location to an Iranian stalkerware company since 2016.
An investigation by Switzerland-based hacker maia arson crimew, has revealed that an Iranian software company that goes by the name ‘virsys’ or ‘virsis’ is to blame.
Having provided TechCrunch with a copy of Spyhide’s text-only database, the publication has now revealed the extent of the attacks, with an estimated 60,000 Android devices thought to have been affected.
Spyhide stalkerware
More than 100,000 location data points had been identified as being uploaded from a single US-based device, with over 3,000 more US devices also contributing to the data logs.
Other regions that have been clear target for the stalkerware maker have included parts of central and eastern Europe, the UK, and Brazil. A considerable number of Indonesian uploads were also identified.
While it is reported that more than 4,000 users were responsible for more than one device, with a handful of individuals responsible for dozens of devices, considerably reducing the number of affected victims, the extent of the operation remains sizeable.
Around 3.3 million text messages containing personal information like two-factor authentication (2FA) codes and password reset links were found, alongside 1.2 million call logs containing the receiver’s phone number and 312,000 call recording files.
Other information, such as 925,000 contact lists, 382,000 photos and images, and an alarming 6,000 ambient recordings from victims’ devices, were also identified by TechCrunch.
Because the app is downloaded from Spyhide’s website rather than the Play Store, Google isn’t to blame for allowing the app on its platform, however enabling Google Play Protect goes some of the way to protecting users from such stalkerware and malware.
Neither of the two Iranian developers, Mostafa M and Mohammad A, have responded to TechCrunch’s emails, however Mohammad A claimed only to have briefly been involved in the project as a contractor around eight years ago in an email to maia arson crimew.
German web hosting provider Hetzner, identified by TechCrunch as the server host for data Spyhide data logs, told the publication that it does not allow the hosting of spyware.
- Think you’ve been a victim? Here are the best identity theft protection tools
