Technical Analysis & Behavior
S2mob (family: Trackplus) is a verified Android stalkerware and covert surveillance application tracked by the Coalition Against Stalkerware and Echap. Also distributed under aliases: Gpspy, S2mob, Spy2Mobile, SpyToMobile, Spymob, sap4mobile, spy2mobile. Associated disguised Android package IDs: com.callhist.calltr, com.catrsy.jaluc, com.cellph.montrb, com.dbzbpr.skt, com.elpatr.woac, com.ernell.thht. Signed with developer SHA1 certificate 0387135D057AEAA0... Linked command/marketing domain: account.spytomobile.com. Once sideloaded with Accessibility, Notification Listener, and Device Admin permissions, it hides its launcher icon and silently exfiltrates SMS messages, call logs, WhatsApp/Signal chats, real-time GPS coordinates, and microphone audio.