Stalkerware operation Spyhide got hacked, rebranded as Oospy, and died again in weeks

Spyhide was a phone-monitoring app facilitating the surveillance of tens of thousands of Android device owners around the world. Stalkerware like it is planted on a victim's phone, often by someone who knows their passcode, then continuously steals contacts, messages, photos, call logs, recordings and granular location history.

In 2023 a hack exposed the operation and the administrators profiting from it, and Spyhide's website disappeared from the internet — but its back-end server, hosted on an entirely different domain, stayed online and kept communicating with the phones it was monitoring. That let the administrators relaunch in late July 2023 as Oospy without disturbing the spying itself.

The second act lasted weeks. TechCrunch identified two administrators, including Mohammad (Mojtaba) Arasteh, who confirmed he had worked on the project "several years ago as a programmer" but denied involvement with Oospy. A mistake on Oospy's checkout page exposed the account-holder name on the PayPal address taking customer payments, and Oospy soon stopped accepting PayPal. On 5 October 2023, web host Hetzner took the back-end server — which stored stolen phone data from thousands of Android devices — offline for violating its terms of service, ending the operation's ability to function.

At least 60,000 victims worldwide, including thousands in the US; the rebrand survived weeks before its server host terminated the contract.

The rebrand kept the burned back end alive on its original domain, so the same infrastructure remained a target and a trace.

Stalkerware economics ran on mainstream rails: PayPal processed the customer payments despite policies prohibiting spyware, and that dependence became the second exposure.

Exposure compounded once researchers named administrators — every operational detail, down to a shared family name on a PayPal account, became evidence.

The web host was the counterparty no rebrand could replace: Hetzner enforced its terms of service and switched the server off.

A rebrand fixes the name, not the leak: the same back end, the same payment rails and the same operational mistakes will find you out a second time.

Oospy's website went offline altogether soon after TechCrunch contacted Arasteh, and the server shutdown marked the end of Spyhide and Oospy's ability to operate — for now. They followed Polish stalkerware LetMeSpy, which shut down after a June 2023 data breach, and SpyTrac, one of the largest known Android spyware apps, which vanished after a TechCrunch investigation linked it to Support King — the maker the FTC had banned from the surveillance industry after an earlier breach.