A vulnerability in Catwatchful, an Android spyware posing as parental control software, exposed the credentials of over 62,000 customer accounts, security researcher Eric Daigle says.
The alleged monitoring application allows users to view content from a victim’s device in real time, tap into the microphone and cameras, and access photos, videos, chat logs, and location.
Catwatchful essentially functions as a powerful spyware, or stalkware, as it runs in the background for real-time monitoring and hides its presence to prevent being uninstalled by the victim.
In fact, while marketing Catwatchful as a parental control application for Android, its developers make it clear that the application is undetectable.
“Yes, you can monitor a phone without them knowing with mobile phone monitoring software. The app is invisible and undetectable on the phone. It works in a hidden and stealth mode,” the developers say.
Catwatchful, Daigle explains, functions as advertised, staying hidden on the victim devices, uploading content to a Firebase database, and allowing registered users to access the content from a web dashboard.
Upon registration, users are provided with an APK pre-configured with their credentials, which requires physical access to the device to be installed. Once up and running, the spyware starts the real-time monitoring capabilities.
Looking into the spyware operation’s innerworkings, the security researcher discovered that it was prone to SQL Injection attacks, that that it was possible to retrieve the Firebase database containing the personal information collected through the user dashboard.
The dump, Daigle explains, contained the plaintext logins and passwords of all 62,050 Catwatchful accounts, along with details linking accounts to devices, and tracking administrative data.
According to the researcher, the exposed information can be used to take over any account on the service.
It also exposed Uruguay-based developer Omar Soca Charcov as the spyware operation’s administrator, along with phone number, email address, and the address of the Firebase database, TechCrunch reports.
In response to the findings, Google added new protections to Play Protect to alert users when it detects Catwatchful on their devices. The web company hosting the Catwatchful API suspended the offending account, but the API was moved to another provider.
The Firebase database has not been removed, as Google is still investigating whether it is in violation of its policies.
While Catwatchful is advertised as undetectable, Android users can check whether it has been installed on their devices by dialing “543210” and pressing the call button. This is a built-in backdoor feature that makes the spyware reveal itself to be uninstalled.
Related: Photo-Stealing Spyware Sneaks Into Apple App Store, Google Play
Related: FreeType Zero-Day Found by Meta Exploited in Paragon Spyware Attacks
Related: European Spyware Investigators Criticize Israel and Poland
Related: Austria Probes Claim Spyware Targeted Law Firms, Banks
