More vulnerable stalkerware victims’ data exposed in new TheTruthSpy flaw

Posted on 27 August 2025, Malwarebytes reports that TheTruthSpy’s Android-based stalkerware contains a flaw that lets anyone compromise any record in the system, after a security researcher demonstrated password changes on test accounts. TheTruthSpy collects extensive data from victims, including call and text activity, GPS‑derived location, and information from messaging apps and files.

The article notes that TechCrunch revealed the servers are vulnerable to attack, and that passwords could be reset to hijack users’ data; the publication isn’t disclosing how the flaw was exploited to prevent abuse, according to TechCrunch. The vendor behind TheTruthSpy is Vietnam‑based 1Byte Software, which warns that consent is required to install the app, yet advertises “stealth mode” that makes it invisible to users.

Swarang Wade, the researcher, demonstrated the vulnerability to TechCrunch by changing passwords on several test accounts, illustrating the risk to victims who remain unaware that their personal data is stored online.