Independent security researcher Swarang Wade found the vulnerability, which allows anyone to reset the password of any user of the stalkerware app TheTruthSpy and its many companion Android spyware apps, leading to the hijacking of any account on the platform. Given the nature of TheTruthSpy, it's likely that many of its customers are operating it without the consent of their targets, who are unaware that their phone data is being siphoned off to somebody else.
Catwatchful is spyware masquerading as a child monitoring app that claims to be "invisible and cannot be detected," all the while uploading the victim's phone's private contents to a dashboard viewable by the person who planted the app.