A major new security vulnerability has been uncovered in TheTruthSpy, one of the most notorious stalkerware apps in operation today. Independent researcher Swarang Wade discovered a flaw that makes it possible for anyone to reset passwords and hijack accounts across the spyware network, giving attackers full access to highly sensitive personal data collected from victims’ phones.
This weakness, confirmed by TechCrunch, is only the latest in a string of serious lapses involving TheTruthSpy and its spin-off brands. For years, researchers and journalists have warned that consumer spyware companies not only enable abusive surveillance but also fail to safeguard the enormous troves of private data they siphon from compromised devices.
A Critical Vulnerability With Real-World Risks
Wade’s finding shows how alarmingly easy it is to break into TheTruthSpy accounts. By exploiting the flaw, an attacker can trigger a password reset for any user, effectively locking out the account holder and taking control of the victim data stored in the spyware’s servers.
When TechCrunch tested the vulnerability with a set of sample accounts, Wade was able to change their passwords in minutes. Attempts to reach the spyware’s operators for responsible disclosure went unanswered.
Instead, Van (Vardy) Thieu, director of TheTruthSpy and its parent company 1Byte Software, told TechCrunch that the “source code was lost” and he could not patch the bug. The flaw remains live at the time of writing, leaving thousands of compromised devices and their unsuspecting owners exposed.
A Long History of Security Failures
TheTruthSpy is far from new to controversy. Launched nearly a decade ago, it grew into one of the most widely used stalkerware networks, marketed under multiple names including Copy9, iSpyoo, and MxSpy. Despite the different branding, all of these apps share the same underlying systems and back-end dashboards.
Unfortunately, they also share the same weak coding practices. Over the years, TheTruthSpy has been responsible for multiple breaches and leaks:
-
2021: A bug exposed the data of over 400,000 victims, including text messages, photos, call logs, and GPS location history. TechCrunch later obtained files from the spyware’s servers that revealed the scope of the surveillance and even built a lookup tool so potential victims could see if their device had been compromised.
-
2021 (later that year): Further reporting uncovered documents linking TheTruthSpy to a massive payment laundering scheme, which used forged identities to route millions of dollars in spyware profits through global banking systems.
-
2023: Another breach spilled the private data of more than 50,000 new victims, once again proving that the company cannot keep its databases secure.
This newly discovered password reset flaw marks at least the fourth major security failure tied to TheTruthSpy, cementing its reputation as one of the most reckless spyware operators still active.
Rebranding to Hide Its Reputation
While parts of the original TheTruthSpy operation have wound down, the spyware has not disappeared. To escape scrutiny, it has rebranded under new names, while still relying on the same fragile infrastructure.
Today, much of the spyware is marketed as PhoneParental, a so-called parental monitoring app that runs on the same buggy dashboards and backend systems. TechCrunch’s review of internet records shows that the spyware still depends on a software stack developed by Thieu known as JFramework (formerly Jexpa Framework).
Thieu has also launched MyPhones.app, presented as a fresh start. But analysis shows that even this new app uses the same JFramework backend, raising serious doubts about whether the vulnerabilities and privacy issues will ever be resolved.
Why This Matters
At first glance, TheTruthSpy’s problems might seem like just another case of poor cybersecurity practices. But in reality, the stakes are much higher.
Spyware like TheTruthSpy is often installed secretly on someone’s device by abusive partners, stalkers, or controlling family members. Once active, it collects everything from messages and photos to live location data. Victims are usually unaware their phone has been compromised, meaning their most private information is continually fed into spyware servers without consent.
Now, with this new flaw, not only can abusers exploit the spyware, but any third party — hackers, criminals, or opportunists — can hijack accounts and steal the same stolen data. In other words, these already vulnerable victims are exposed twice over: once to their abuser and again to anyone who knows how to exploit the bug.
This case demonstrates why stalkerware apps are inherently unsafe. They encourage illegal surveillance and then fail to secure the enormous amount of personal data they harvest. Even the people paying for these services risk exposure, since customer data is often swept up in the same leaks.
The Bigger Picture: Spyware Industry Still Dangerous
According to TechCrunch, TheTruthSpy is just one of at least 26 spyware operations that have leaked or exposed data in recent years. Despite repeated scandals, spyware makers continue to operate by shifting names, changing branding, and routing money through shady payment processors.
This cycle allows them to continue profiting while leaving behind a trail of compromised victims and insecure systems. For regulators, law enforcement, and technology platforms, the persistence of stalkerware highlights the urgent need for stronger enforcement and public awareness.
What to Do If You Suspect Spyware on Your Phone
If you believe your device may be compromised by spyware like TheTruthSpy or PhoneParental, take action:
-
Check your device: TechCrunch maintains a lookup tool where you can see if your phone was listed in previous leaks.
-
Use anti-stalkerware resources: The Coalition Against Stalkerware provides guides for detecting and removing spyware from your phone.
-
Seek support: If spyware is being used as part of an abusive relationship, contact the National Domestic Violence Hotline (1-800-799-7233) in the U.S. for confidential help. If you’re in immediate danger, call 911.
Conclusion
TheTruthSpy’s ongoing security failures show that stalkerware companies cannot be trusted with anyone’s data. They promote illegal surveillance, expose victims to abuse, and repeatedly fail to protect the stolen information they collect.
With yet another unpatched flaw threatening thousands of people, the spyware industry once again proves that it is not only unethical but dangerously irresponsible.
Until stronger action is taken against stalkerware makers, the burden will fall on victims and their allies to stay alert, secure their devices, and push for accountability in an industry built on secrecy and exploitation.
