Cerberus is one of the longest-running stalkerware apps on Android.
We reverse-engineered their ecosystem to document how it operates, and why Google must remove it from the Play Store, stop monetizing it through AdMob, and stop hosting the Firebase Cloud Messaging that runs its C2.
tl;dr https://hexproof.dev/datagrams/cerberus-on-play/
deep dive https://hexproof.dev/datagrams/cerberus-stalkerware-re/
Cerberus is stalkerware. Google Play hosts it.
Cerberus on Google Play: €5/month buys silent camera, microphone, GPS, and SMS access on a victim's phone. Researchers reported it to Google as intimate-partner-violence spyware in 2018; Google removed it later that year on an unrelated policy and relisted it in 2023. Google AdMob pays the developer; Google Firebase hosts the command-and-control backend.