LightSpy is a spyware platform developed in China and currently operating in at least 13 countries across Europe, Africa, the United States, and China itself, according to Arctic Wolf Networks and multiple cybersecurity researchers [1, 2, 3, 4]. The platform offers customers access to advanced spying services such as stealing precise location data, sound recordings, chat histories, video and camera feeds, and screen recordings [1, 2, 3, 4].

LightSpy also features pricing tiers, billing infrastructure, custom branding, and even a demo environment for prospective clients, illustrating its commercial approach to surveillance tools [1, 2, 3, 4]. It supports targeting various devices including smartphones, Apple devices, Linux servers, Windows PCs, and network routers [4]. The spyware can remotely wipe or destroy data on infected devices [1, 2, 3, 4].

The platform operates at scale with at least 117 servers distributed globally [1, 4]. Customers within China include enterprises, government agencies, military organizations, and educational institutions [1, 2]. Arctic Wolf Networks linked the operators of LightSpy to Chinese state-backed actors and is coordinating with the U.S. Department of Homeland Security and FBI over the threat [1, 2, 3].

Cybersecurity researchers traced a LightSpy operator in China who accidentally revealed his real name and office location by using the spyware’s billing system to order KFC fried chicken about four years ago [1, 2, 3, 4]. This error helped confirm the platform's Chinese origins and links.

Justin Moore, Arctic Wolf’s Director of Threat Intelligence Research, said, "LightSpy reflects a broader shift in the spyware market as surveillance is becoming a product, not just a one-off operation or piece of malware. When advanced espionage capabilities can be packaged, sold, and reused, the number of bad actors capable of conducting sophisticated surveillance grows dramatically" [3]. He added that the proliferation of such tools raises the risk they will be used to monitor, intimidate, or suppress opposition voices [2].

LightSpy was first discovered in 2018, and its public disclosure came on August 5, 2026, when Arctic Wolf Networks revealed its capabilities and global reach [4, 1, 2, 3].

Arctic Wolf Networks continues urgent talks with U.S. security agencies as investigations into LightSpy’s operations and customers proceed.