What Happened?
A major security flaw has exposed Catwatchful, a stealthy Android spyware app disguised as a child-monitoring tool. Security researcher Eric Daigle uncovered a massive data leak that spilled 62,000 customer email addresses and plaintext passwords, along with sensitive data stolen from 26,000 victim devices worldwide.
Even more shocking, the breach revealed the identity of Catwatchful’s Uruguayan developer, Omar Soca Charcov, exposing the individual behind one of the most invasive stalkerware operations in recent years.
What is Catwatchful Spyware?
Catwatchful markets itself as a “hidden parental control app”, but in reality, it is stalkerware—software designed for covert surveillance of unsuspecting individuals.
Once installed, Catwatchful can:
-
Steal photos, text messages, and call logs
-
Track real-time location data
-
Access the phone’s microphone for live audio spying
-
Hijack both front and rear cameras remotely
-
Remain invisible on the device
Such apps are banned on official app stores, as they are often used by abusive partners or stalkers.
How the Data Breach Happened
Daigle discovered that Catwatchful’s custom-made API was left wide open without authentication. This flaw allowed anyone on the internet to access the spyware’s entire database—including customer logins and stolen victim data.
Even worse, Catwatchful stored victim data (photos, audio, and location logs) on Google’s Firebase servers, making it dangerously easy for outsiders to intercept private information.
Key findings:
-
62,000 Catwatchful customers exposed
-
26,000 victims’ data stolen
-
Victims mostly located in Mexico, Colombia, India, Peru, Argentina, Ecuador, and Bolivia
-
Records date back to 2018
The Spyware Operator Unmasked
Through a massive operational security mistake, Catwatchful’s own administrator was revealed in the leaked database.
-
Name: Omar Soca Charcov
-
Location: Uruguay
-
Personal & admin emails tied to Catwatchful
-
LinkedIn account linked directly to the spyware
This rare exposure highlights just how fragile and reckless stalkerware operations can be.
Response from Google and Hosting Providers
After the breach was reported:
-
Google Play Protect updated its defenses to detect and warn users about Catwatchful.
-
The spyware’s hosting was temporarily suspended, but later reappeared on HostGator servers.
-
Google confirmed it is investigating whether Catwatchful violated Firebase’s terms of service.
However, as of now, Catwatchful remains active and continues to pose a threat.
How to Detect Catwatchful on Your Device
Catwatchful claims it “cannot be uninstalled”, but there are ways to check if it’s on your phone.
👉 Detection code: Dial 543210 in your phone’s dialer and press call.
-
If Catwatchful is installed, the hidden app will appear.
-
This backdoor was built so the spyware operator could re-enable hidden access—but it also helps victims discover it.
How to Remove Catwatchful Spyware
If you suspect Catwatchful (or any spyware) is on your phone:
-
Make a safety plan first – removing spyware may alert the abuser.
-
Run Google Play Protect scans.
-
Use trusted anti-malware apps to scan for hidden software.
-
Manually uninstall Catwatchful once detected.
-
Perform a factory reset if removal is unsuccessful.
📌 For detailed steps, check TechCrunch’s spyware removal guide.
Why This Matters
The Catwatchful breach is the fifth major spyware leak this year, proving that consumer-grade stalkerware is not only dangerous for victims but also poorly secured for its paying customers.
While spyware developers market their apps as parental control tools, in reality, they:
-
Enable illegal surveillance
-
Violate privacy laws
-
Put victims at risk of stalking, abuse, and identity theft
Final Thoughts
Catwatchful’s downfall is yet another warning: spyware apps are not safe, not legal, and not secure. They harm both victims and customers while exposing operators who think they can stay in the shadows.
If you or someone you know suspects spyware, seek help immediately:
-
📞 National Domestic Violence Hotline: 1-800-799-7233
-
🌐 Coalition Against Stalkerware: stopstalkerware.org
Stay alert, stay safe, and keep your devices spyware-free. 🚫📱
