Stalkerware Use Increasing Among Russian Users
Analysts from Kaspersky Lab have published a report addressing the growing problem of stalkerware—software designed for surveillance that is marketed as legal and available for purchase openly. These programs are often used to secretly monitor individuals without their consent.
Global and Russian Trends
According to the researchers, in the first eight months of this year (January to August), more than 37,000 users worldwide encountered stalkerware threats. This represents a 35% increase compared to the same period in 2018.
However, the number of affected users in Russia is growing even faster than the global average. Kaspersky’s statistics show that from January to August 2018, just over 4,500 Russian users encountered stalkerware. In 2019, that number nearly doubled to almost 10,000. This means the number of victims in Russia has more than doubled in just one year.
More Stalkerware Variants Detected
The researchers also noted an increase in the number of stalkerware samples. In the reporting period of 2019, Kaspersky detected 380 different variants of stalkerware—almost a third more than the previous year.
“Compared to the much higher rates of malware infections, the statistics for stalkerware may not seem as impressive. However, with this type of surveillance software, there are usually no random victims—most often, the targets are people well known to the person organizing the surveillance, such as a spouse. Additionally, the use of such software is often linked to the threat of domestic violence. Installing the software typically requires physical access to the device, which is why the numbers are significantly lower,” explained Vladimir Kuskov, Head of Mobile Threat Research at Kaspersky Lab.
Most Common Stalkerware Detected
The most frequently detected malware was Monitor.AndroidOS.MobileTracker.a, which is marketed as a tool for monitoring employees. In reality, this malicious software can secretly monitor users by disguising itself as a system app and collecting a wide range of confidential data. This includes geolocation information, SMS and messenger conversations, phone calls, photos and videos, real-time camera recordings, browser history, files, and information from calendars and contact lists. Additionally, the program allows remote control of the infected device.