A massive data leak has revealed the widespread use of spyware app Cellular 007, originally marketed as a parental control tool
Reporting from Rio de Janeiro, Allan de Arbreu reveals that thousands of people have been implicated in one of Brazil’s largest personal data privacy breaches. The investigation by piauí exposes the sinister reality behind the ominously named application Cellular 007, which claims to have more than one million downloads. Originally designed to allow parents and guardians to supervise their children’s digital activities, the program was openly sold online and widely available for download. It became used for clandestine police investigations, stalking, and espionage of all kinds.
By breaking into the Cellular 007 system, a hacker syndicate exposed that thousands of conversations had been illegally intercepted. The group shared this material with DDoSecrets, an organization that publishes, archives, and analyses leaked datasets. DDoSecrets then sent the data to InterSecLab, a digital security and forensics laboratory which analyzed and compiled the leaked information at piauí’s request. The results are staggering: between January 2015 and May 2024, at least 116,079 cell phones were monitored by 105,897 users of the application in Brazil.
Among those spied on was Lima, a music promoter from Pernambuco. One late night in October 2021, he texted his friends: “The police came to kill me on Saturday”. The message was alarming, as Lima wasn’t a high-profile criminal and had no reason to believe he was targeted by law enforcement. His crime was organising the Bailão do Só Amigo, a party for twenty thousand in the midst of the pandemic – an event the police had detected through illegal surveillance carried out via the app.
The leaked data included intercepted conversations involving public officials and ordinary citizens across the country. There are also clues indicating who carried out the spying, since users must register with an email address. The person who hacked Lima’s cell phone, for instance, was registered with the following address: danielpcpe@gmail.com. The acronym PCPE is usually used to refer to the Civil Police of Pernambuco, the state where Lima lives.
De Arbreu explains that the use of such an application is only permitted by law when a parent is monitoring their own child – and even then, the minor’s right to privacy must be respected. In all other cases, it’s illegal, as both the interception of communications and the invasion of electronic devices are prohibited in Brazil. In essence, anyone – especially state institutions – who uses Cellular 007 to monitor others is committing a crime.
Despite this, the app continues to boom. De Arbreu attributes its popularity to its easy access: it can be purchased in seconds, without a lengthy registration process, and it is very cheap. The basic package costs 209 reis (roughly £30/$40) for fifteen days. To activate the app, users must initially have physical access to the phone the intend to monitor. (It only works on Android devices, so iPhone users are safe for now.) Once activated, it allows full surveillance, including encrypted chats like WhatsApp, remote access to microphone and camera, and real-time location tracking.
There are around a dozen similar applications currently operating in Brazil, all marketed under the pretext of monitoring minors’ online activity (or, in some cases, romantic partners, as with apps such as Rastreador de Namorado – literally, Boyfriend Tracker). The use of such spyware is nothing new. Under the Bolsonaro administration, Bruno Espião was illegally used by Highway Police agents to illegally monitor people.
Marla Rivera, the Director of IntersecLab, claims that “Spyware programs like Cellular 007 proliferate on the internet without any control. And they are poorly designed, fragile programs from an information security standpoint”. She adds that “victims suffer a double violation: they are monitored without their consent and also run the risk of having their personal data publicly exposed.”
By analysing the leaked data, piauí found several email addresses from public institutions registered as users of the app. Among those exposed were members of the Military Police and employees of the Judiciary: “precisely those that should be monitoring and curbing the use of the application”, de Arbeu notes. Their victims included ordinary citizens as well as politicians and their advisors such as Deividi Lira Martins, former advisor to state deputy Adriano José da Silva (PP-PR). When told by piauí that he was a victim of illegal espionage Martins said he was not surprised. He recalled a suspicious moment during the 2020 election: “I was talking on the phone with the congressman when I heard a noise, like a train passing by, and then it started to echo.”
Although espionage has been prohibited in Brazil for more than two decades, the country has never fully eliminated it. In the early years after the return to democracy, the problem was largely confined to sectors of the police, a legacy from the dictatorship. Today, in the digital age, with the widespread use of smartphones, surveillance technology is more accessible than ever. A new era of espionage has dawned.
Original article in Portuguese by Allan de Arbreu published by piauí as ‘O aplicativo que espionou 100 mil celulares – e continua em atividade’ on the 18th of September 2025.
It is available here.
piauí is a Brazilian culture magazine known for its long-form journalism, essays, and literary reporting.
Summary by TMH.
