Cybersecurity researcher Jeremiah Fowler uncovered a large leak of private photos, screenshots, and messages linked to a well-known European celebrity and several social media figures. The files were stored in a publicly accessible database with no password protection, exposing 86,859 images.
Further analysis showed many screenshots were taken directly from a victim’s phone, which points to the use of stalkerware. The leak also contained private chat logs from apps such as WhatsApp, Facebook, TikTok, and Instagram.
Fowler suspects that the person(s) who set up the stalkerware probably didn’t put a password on their storage folder, which is why anyone with an internet connection and the ability to find misconfigured and unprotected servers could access these private files.
Details of the Leak
The data, as per Fowler’s research published by ExpressVPN and shared with Hackread.com, contained very personal details like romantic messages and private photos. In addition, the files also had phone numbers, email addresses, and photos of ID documents like invoices and receipts. The stalkerware even caught messages sent to influencers who have millions of followers.
The main victim is a prominent European entrepreneur and media personality, and some popular influencers, but Fowler didn’t name those involved to protect their privacy. However, he used the leaked phone numbers to call and warn them, and also informed law enforcement about the situation to stop the tracking.
“I identified that the victim of the spyware is a prominent European celebrity, entrepreneur, and media personality. The images capture chat conversations with influencers that have millions of followers, as well as with friends, family, business associates, and others. For privacy reasons, I cannot identify the victim or others whose private communications were unknowingly exposed,” said Fowler.
What is Stalkerware
Stalkerware is a spying tool that a hacker or someone known to the victim secretly installs on a phone to track everything they do. Usually, it is used to monitor children, but threat actors use it to spy on others for their own gains. “The software operates covertly without any indications that it has been installed,” Fowler explained in his blog post.
He further noted that this stalkerware can see GPS locations, read texts, and even turn on the phone’s camera or microphone. Generally, an attacker needs physical access to the device for a few minutes to install it, and once this is done, it sends all the data to a remote server.
Although apps like WhatsApp are considered safe because of using end-to-end encryption, spyware can take pictures of the screen. As Fowler mentioned, “encryption only protects data in transit,” so when a message shows up on the screen, the spyware grabs it.
Fowler concludes with some tips for the users. There are signs to tell if your phone has spyware, such as the phone’s battery dying quickly or the device getting too hot for no reason. So, look for these signs. Fowler also suggested always using strong passwords and never letting others hold your phone without your supervision.
If you suspect stalkerware is on your phone, look for unfamiliar/suspicious apps, run antivirus checks, inspect device administrator settings and accessibility permissions, and perform a full factory reset to remove the spyware.
