Cybersecurity researchers have identified a major expansion of the LightSpy spyware platform, with activity now detected in 13 countries, including the United States and several European markets. First seen in 2018, the tool has evolved into a more advanced system with broader targeting capabilities.
According to Arctic Wolf, LightSpy has shifted from an early spyware strain into a commercial platform with branding, billing, and demo materials aimed at potential clients. The researchers say it is now operated by a single threat actor serving government, enterprise, and military customers.
The modular spyware can be adapted for multiple environments, including smartphones, Apple devices, Linux servers, and Windows PCs. Once deployed, it can collect location data, messages, screen recordings, and stored passwords. It also includes functions that can remotely disable or damage compromised devices.
A notable development is its use against routers, a tactic that can expose every device connected to the same network. Arctic Wolf also reported infrastructure tied to the campaign across at least 117 servers in different countries, showing a wide and organized technical footprint.
The latest activity was linked to a Chinese contractor after one operator reportedly used the administrator panel to place a food order with a real name and office address, helping researchers connect the platform to its operator.
This case highlights how advanced spyware is becoming more industrialized, and it may shape the future of digital security, pushing organizations toward stronger network defense and device protection.
