2 Million mSpy Records Leaked Will Create Convincing Spearphishing Emails

It wasn’t long ago when spy software with a vulnerability was mentioned in the news. Now, it is making headlines again. The commercial spyware, mSpy is the newsmaker this time because it has leaked over 2 million records due to an unsecured database. Security researchers were able to retrieve the records that included software purchases, usernames, and authentication tokens, among other information, after being notified of it by bug hunter Nitish Shah. 

This is yet another example of how important it is to configure and secure all systems properly. There are numerous examples of misconfigured databases that resulted in serious breaches. Not only do mistakes like this put a company’s reputation at risk, but the cost to correct it can be a hard pill to swallow. And unfortunately, it isn’t really possible to put a dollar figure on the cost to an organization’s reputation when something like this happens.

The database has since been taken offline, so no further damage should be done. However, it is unknown if someone with malicious intent accessed it at some other time and if he or she may have used it for personal gain. In the meantime, those with accounts on mSpy should be careful of targeted phishing using the mSpy name. Since the usernames were accessed, phishers could use the fact that you have an account to send email using the mSpy branding in hopes that you will click something. Particularly possible is that you may receive a link in an email asking you to click it to verify your account. If this does happen, don’t click the link. Go into your account directly and verify information that way.

As more information trickles out to the Internet or is made available on the dark web, it can allow the criminals to build profiles and weaponize the data to be used against us. The mSpy breach may not in itself seem like a big deal compared to some of the other breached like Yahoo and Equifax, but the reality is that criminals are putting the data together from all breaches to create very personal and targeted phishing scams. This is what is known as the weaponization of data. The more personal identifiable information (PII) a phishing email has, the believable it is, increasing the odds that the target click on the link or opens the attachment.  

There isn’t a lot an individual can do once someone has our information, to keep it secure. What we can do is be smart about handling what information we receive. If an email arrives that is unsolicited, unexpected, or from an unknown sender, and contains a link or attachment, it should be met with considerable skepticism. Take a minute to call the sender or even send a text to confirm that he or she really did intend to send it and that it’s legitimate information.

And don’t get caught up thinking that phishing only happens in email. It still happens using the telephone too. If someone calls asking for personal or sensitive information and you didn’t initiate the communication, don’t give out any details. This applies even if they appear to know a lot of information about you already. Instead, find a phone number online, call the company the caller claimed to be from, and verify the information. Remember that government agencies will never initiate conversation with you using the telephone. They will send a letter in the mail first.

Smishing is another up and coming method for phishing. That is when links or attachments, including images, are sent via text or SMS. Again, use the same checks before clicking anything. If it’s out of the blue, it could be malicious. Don’t give out any sensitive information when contacted this way.

Even if the message is personalized, it doesn’t mean it’s not malicious. Remember, as information is gathered and folios are created, the cybercriminals have what they need to do some quality trickery. It’s important to verify everything independently before giving out information that can be used to steal our identities.

The mSpy software is designed for those who want to watch after their children, partners, or others. It is not malware in the sense that it will linger on your system and retrieve information and send it off to “bad guys” somewhere. But the fact that someone has your information does leave the door open for phishing attacks. Always be on the lookout for those.