Spyware app pcTattletale was hacked and the website was made unreadable

US-made consumer spyware app pcTattletale has been hacked and its internal data published on its website, according to a hacker who has claimed responsibility for the breach.

The hacker posted a message on pcTattletale’s website late Friday, claiming to have hacked into the servers containing pcTattletale’s activities. The spyware maker’s website briefly contained links to files from its servers, which appeared to contain stolen data from some victims. JS does not link to the site due to the continued risk to victims, whose private information has already been compromised by the spyware.

pcTattletale’s founder Bryan Fleming did not return an email requesting comment. It’s not clear if Fleming will be able to receive email due to his company’s ongoing outage.

The hacker did not provide any specific motivation for the breach. The hack comes days after a security researcher said he found and reported a vulnerability in the spyware app itself, which leaked screenshots of the devices it was placed on. The investigator, Eric Daigle, said he has not published specific details of the error because pcTattletale ignored requests to fix the vulnerability.

The hacker who compromised and defaced pcTattletale’s website did not exploit the vulnerability Daigle discovered, but said pcTattletale’s servers could be tricked into handing over the private keys to his Amazon Web Services account, which gives access to the activities of the spyware.

pcTattletale, a type of remote access app often called “stalkerware” due to its ability to track people without their knowledge or consent, allows the person who installed the app to remotely control the Android or Windows device of the target and its data from anywhere in the world. world. pcTattletale says the app “runs invisibly in the background on their workstations and cannot be detected.” Spyware apps are stealthy by nature and therefore difficult to identify and remove.

Earlier this week, JS revealed that pcTattletale was used to compromise the front desk check-in systems of several Wyndham hotels in the United States, leaking screenshots of guest data and customer information. Wyndham would not say whether it authorized or allowed its franchise hotels to use the spyware app on its systems.

This is the latest example of a spyware maker losing control over the highly sensitive and personal data it collects from its targets’ devices. According to an ongoing count by JS, more than a dozen spyware and stalkerware companies have hacked or otherwise leaked victims’ private data in recent years — in some cases multiple times.

That list of hacked spyware makers includes LetMeSpy, a spyware created by a Polish developer, which was shut down in June 2023 after its systems were hacked and its backend data deleted; and TheTruthSpy, a phone spyware operation created and operated by Vietnamese developers, which was hacked again in February.

Other hacked spyware makers include KidsGuard, Xnspy, Support King, Spyhide – and now pcTattletale.