Technical Analysis & Behavior
Spyone (family: Spyone) is a verified Android stalkerware and covert surveillance application tracked by the Coalition Against Stalkerware and Echap. Associated disguised Android package IDs: com.jgeuhcex.ejcxndak, com.eytewqrm.wvdkgmrl, com.epbzrqcg.syzzkuqx, com.laucass.phonecontrolenabler, com.laucass.phonecontroltarget, com.laucass.androsmscontrol. Signed with developer SHA1 certificate C4B56E3768543190... Linked command/marketing domain: spyone.pl. Once sideloaded with Accessibility, Notification Listener, and Device Admin permissions, it hides its launcher icon and silently exfiltrates SMS messages, call logs, WhatsApp/Signal chats, real-time GPS coordinates, and microphone audio.