A stealth app called Catwatchful has allegedly been caught in its own trap after a major security flaw exposed sensitive data of both its users and victims. The app, which disguises itself as a child-monitoring tool, has been silently stealing data from thousands of Android phones – including photos, messages, location details, and even live audio from microphones and cameras. But a newly discovered vulnerability has turned the tables.
Canadian security researcher Eric Daigle found that Catwatchful’s database was completely exposed online due to a misconfigured, unauthenticated API. This meant that anyone could access sensitive data, including the email addresses and plain-text passwords of over 62,000 customers, along with private phone data from more than 26,000 victims.
The majority of affected devices were located in countries like India, Mexico, Colombia, Peru, Argentina, Ecuador, and Bolivia. The exposed data includes records stretching back as early as 2018. In a blog post, Daigle explained that Catwatchful operates by being manually installed on a victim’s device by someone with physical access – often a romantic partner or family member – making it a form of stalkerware.
Daigle’s investigation also revealed that Catwatchful used Google Firebase to host stolen data, like users’ photos and real-time audio recordings. Upon being alerted, Google said it had added Catwatchful to its Play Protect tool to warn Android users of the spyware.
The breach didn’t just expose victims, it also revealed the identity of Catwatchful’s operator. The developer behind the spyware was identified as Omar Soca Charcov, a software engineer residing in Uruguay, according to a report by TechCrunch. Charcov’s details, including his personal email, phone number, and even the Firebase web address used to store stolen data, were found in the database. Charcov’s LinkedIn profile used the same email address found in the spyware data, as per the report. He reportedly also linked his personal email account to the administrator account for Catwatchful, making it easy to trace him as the operator.
Following the discovery, Daigle informed the hosting provider for Catwatchful’s API, which briefly suspended the spyware’s services. However, the API later returned via HostGator. Google is apparently reviewing whether Catwatchful violated its Firebase terms, but at the time of writing the story, the app’s database remains online.
– Ends
