Cybersecurity researcher Jeremiah Fowler found 86,859 screenshots from a single person’s phone sitting in an unprotected database, readable by anyone with an internet connection. The victim used WhatsApp. WhatsApp uses end-to-end encryption. The encryption did nothing.
That gap between “encrypted” and “protected” is the story. Stalkerware does not break encryption. It reads the screen after the phone has already decrypted the message and rendered it in pixels. The attack surface is not the network. It is the operating system’s accessibility layer, and it has been commercially exploited for over a decade.
The Accessibility Service Attack Path
Every major mobile operating system provides an accessibility layer, an API that allows screen readers, switch access devices, and assistive tools to interact with whatever is currently displayed on screen. On Android, this is AccessibilityService. The API was designed to support users with disabilities. Screen readers need deep UI access. Stalkerware needs exactly the same access.
When a stalkerware app gains AccessibilityService permission, it receives event callbacks every time the screen content changes. It can read every text node rendered on screen, capture screenshots of any foreground app, and log keystrokes as they are typed. Android’s developer documentation for AccessibilityService.ScreenshotResult confirms this capability is available to any granted service, not just OEM-sanctioned tools.
A security researcher publishing under the handle Chocapikk documented the full attack surface in February 2026. Their analysis confirmed that Android 14 introduced isAccessibilityDataSensitive, a flag that app developers can set on sensitive UI views to restrict accessibility service reads to declared tools like TalkBack. As of February 2026, no major messaging application implements it. WhatsApp message text sits in readable accessibility nodes, open to any granted service.
The attack sequence on Android looks like this:
- Perpetrator installs stalkerware via sideloaded APK or a disguised monitoring app, typically requiring brief physical access to the device
- App requests
BIND_ACCESSIBILITY_SERVICEpermission during a guided setup, often framed as a configuration step - After grant, the service registers listeners for
AccessibilityEvent.TYPE_WINDOW_CONTENT_CHANGED - On every screen update, including when a message decrypts and displays, the service reads the UI tree or calls
takeScreenshot() - Captured data transmits to a cloud-hosted command-and-control dashboard over HTTPS
WhatsApp’s TLS encryption is irrelevant at step four. The message reached the device, was decrypted by the application, and became pixels before the accessibility service captured them. This is not a flaw in WhatsApp. It is a fundamental property of screen-level surveillance: encryption protects data in transit between systems, not data displayed to a user already holding the decryption keys.
MITRE ATT&CK catalogs this under technique T1513, Screen Capture, and documents three capture methods: AccessibilityService events, MediaProjectionManager with user consent, and root-level commands via ADB. Commercial stalkerware primarily uses the accessibility path because it requires no root access and runs on every modern Android device sold since Android 9.
The Second Failure: The Perpetrator’s Own Infrastructure
The 86,859 screenshots were exposed not because of a flaw in the stalkerware itself, but because the person operating it failed basic cloud storage hygiene. This is the part most coverage missed entirely.
Fowler’s report describes a non-password-protected, publicly accessible database named after a known commercial spyware service, which appeared to be operated by an individual rather than the vendor. Cloud object storage buckets require explicit access control configuration. Many deployments, particularly older or manual setups, default to world-readable if not explicitly locked down. Someone built a surveillance operation, stood up their own storage endpoint, and forgot to set authentication on it.
Commercial stalkerware products work by exfiltrating captured data from the victim’s device to a cloud dashboard the abuser logs into remotely. The perpetrator here apparently built their own endpoint, possibly naming it after a commercial product to obscure its origin, and left it open. The files were browsable by anyone who found the URL.
This is a documented pattern. AV-Comparatives’ 2025 stalkerware industry report noted that security research has shown stalkerware vendors frequently operate insecure servers, and multiple vendor breaches have exposed victim data publicly before forcing vendor shutdowns. In 2025, Cocospy, part of the TheTruthSpy network, leaked 3.2 million customer email addresses via a separate vulnerability. Researcher hexproof’s April 2026 analysis found what appears to be a Cocospy-linked repository still publicly accessible a year after the original shutdown, which is where Fowler’s current discovery originates.
The structural problem: stalkerware operations collect sensitive data at scale, store it on cloud infrastructure controlled by the abuser, and the abuser is typically not a competent infrastructure operator. The result is a second victim class. The abuser’s poorly secured data leaks, and everyone whose private communications were captured becomes exposed not just to their stalker but to the open internet.
Why End-to-End Encryption Gave the Wrong Impression
The 86,859 screenshots included private WhatsApp conversations, Facebook messages, Instagram DMs, and TikTok activity. Each of those platforms markets end-to-end encryption or equivalent privacy protections. None of that protection was breached. All of it was irrelevant once the device was compromised.
E2EE provides an accurate but narrowly scoped guarantee: data cannot be read in transit between sender, recipient, and the servers that route it. It says nothing about what happens at the endpoint after decryption. A compromised device is a compromised endpoint. The encryption layer terminates at the application process. The stalkerware operates at the accessibility layer, which sits above it in the rendering stack and executes after decryption has already completed.
This distinction matters beyond the stalkerware context. Anyone deploying AI agents, automation workflows, or developer tooling that depends on encrypted communication channels is operating with the same assumption boundary. Encryption secures the network path. The device is a separate problem, one that no amount of transport-layer security addresses.
What Technical Users Can Actually Check
Generic detection advice misses what an informed user can verify directly.
The accessibility service audit on Android is the most reliable starting point. Go to Settings, then Accessibility, then Installed Services or Downloaded Apps (the path varies by manufacturer). Any app listed there that you did not deliberately grant accessibility permissions to is suspicious. No legitimate messaging app, utility, or media application requires accessibility service access. Note the package name of anything unfamiliar and search it before dismissing it.
ADB provides visibility the settings UI hides:
adb shell dumpsys accessibilityThis command lists every registered accessibility service, including apps that have removed their launcher icon from the home screen. A package appearing here that does not appear in your installed apps list is a serious indicator of compromise.
Battery statistics reveal background activity patterns:
adb shell dumpsys batterystats | grep -A 20 "Uid u0a"An app showing high total runtime against near-zero screen-on time, combined with continuous location requests at regular intervals, matches textbook stalkerware behavior. The security blog at shellnetsecurity.com documented this technique in a February 2025 forensic analysis, showing GPS polling at once-per-minute intervals producing 1,440 location requests in a 24-hour period as a detection signature.
Amnesty International’s Security Lab maintains the Mobile Verification Toolkit, an open-source forensic tool that analyzes both Android devices via ADB backup and iOS devices via encrypted iTunes backup. MVT checks against the stalkerware-indicators IOC database, which is updated by security researchers and consumed by Quad9, AdGuard, TinyCheck, and MISP. Running MVT is a concrete, low-overhead check for high-risk individuals, including executives, journalists, and anyone with reason to believe their device has been physically accessed by someone untrusted.
On iOS, the threat model differs. Apple’s sandboxing prevents the accessibility service abuse path available on Android. Stalkerware on unmodified iOS requires either MDM profile installation or a jailbroken device. Check under Settings, General, VPN and Device Management. Any MDM profile you did not install yourself warrants immediate investigation.
Where the Research Falls Short
Fowler’s report withholds the identity of both the victim and the specific commercial product the database was named after. That protects the victim but prevents security teams from confirming detection signatures against this specific case. Without the exact stalkerware package name, responders cannot verify whether their existing tools catch it.
The report also cannot confirm whether the storage endpoint was secured after Fowler notified law enforcement and the victim. The exposure window is unknown. The data may have been indexed, downloaded, or copied before access was restricted.
Google’s Play Store enforcement gap is public and documented but unresolved. The Cerberus stalkerware app, analyzed by hexproof in April 2026, remained on Play continuously since October 2023 under a renamed package identifier, with its accessibility service capture intact. Google’s Stalkerware Policy has been in effect since 2020. The Federal Trade Commission acted against Retina-X in 2019 and SpyFone in 2021. No equivalent enforcement followed for subsequent violations through the documented period.
Android 14’s isAccessibilityDataSensitive API is a genuine architectural fix. It does nothing without developer adoption. Until messaging applications implement the flag on their message display views, accessibility-based capture has a clear, unobstructed read path to every decrypted message on Android.
What Happens Next
The enforcement pressure is moving to Europe. Google Play is classified as a Very Large Online Platform under the Digital Markets Act, which gives the European Commission direct enforcement authority over platform-side policy violations. The Cerberus case, documented with specific package identifiers, Play Store URLs, and Firebase project links, is the kind of factual record DMA compliance proceedings can act on without requiring new investigation.
Detection tooling will improve incrementally. MVT now consumes the stalkerware-indicators IOC database upstream, meaning newly identified stalkerware packages reach consumer detection tools within one feed update. The Coalition Against Stalkerware, founded in 2019 by EFF and cybersecurity companies including Kaspersky and F-Secure, continues to coordinate sample sharing and detection criteria across the security industry.
The 86,859 screenshots from a single compromised phone exposed private conversations involving hundreds of people who never knew they were being recorded. The encryption those people relied on worked exactly as designed. The problem was one permission grant, one weak cloud configuration, and a surveillance industry that operates at consumer scale with essentially no platform enforcement.
Encryption is a network-layer property. The device is a different problem. The Fowler breach makes that distinction visible at scale.
Primary sources: Jeremiah Fowler via ExpressVPN Research (April 30, 2026); hexproof, Cerberus is stalkerware. Google Play hosts it. (April 2026); Chocapikk, Android’s AccessibilityService: A Single Toggle to Total Device Control (February 2026); MITRE ATT&CK T1513; AV-Comparatives Stalkerware Test 2025; Android Developer Documentation, AccessibilityService.ScreenshotResult.