Google delays action against spyware operation Catwatchful hosted on its platform

Google recently suspended the account of Catwatchful, a phone spyware operation that had been hosted on its Firebase platform for over a month. This spyware, disguised as a child-monitoring app, was designed to secretly track a victim’s private information such as messages, photos, and location. After TechCrunch alerted Google in mid-June, the company took a month to investigate and shut down the operation. Catwatchful was primarily targeting Android users, and the app required physical installation on the victim’s phone, often with prior knowledge of the phone’s passcode. The spyware had been storing massive amounts of stolen data, including personal details of over 26,000 victims. The breach was discovered when a security bug exposed the back-end database, revealing customer emails, passwords, and compromised devices. Although Google eventually shut down the operation, the delay in action raises concerns about the effectiveness of its platform’s security measures. This is the latest incident in a growing trend of spyware breaches, with Catwatchful being the fifth spyware operation to leak sensitive data in 2025 alone. As a response, users can identify and remove the app using a special code, but experts warn to have a safety plan in place before doing so.