I was on the Kik messenger app, and someone in a group chat posted screenshots of his modded Kik app that contains an "IP grabber". He said he could hack people easily, and was very fast to tell me my own IP address. He was able to tell when anyone in the chatroom was lurking (i.e watching the chat without typing), for how long, their last activity, etc. I have no idea how, but he was able to know my IP address along with 2 other people in the chatroom. Prior to this, he had sent me a picture which I downloaded a week ago. He has not sent me any links, and I have certainly not clicked on any links from him. We had a few messages back and forth, but that's it. He said that he would hack me, so I logged out a few hours later. I used AVG antivirus and Kaspersky to scan my phone, and there were no issues detected. I manually checked my downloaded apps on Android, and there wasn't any downloaded app that was new. I have since then logged out of Kik, but I am concerned: could he be spying on my phone, and what can I do to prevent this?
There is no indication they were spying on you. All information they had was publicly available. Saying they know your IP address is like saying they know your phone number after you called them. I mean yeah, you'd have to have a phone with a display to know the callers number, but that's not exactly a hacking tool.
Your IP address is no secret. To the contrary, everybody you connect to on the internet has to know your IP address, otherwise you cannot send or receive anything.
So can a random guy who tells you they know the equivalent of your phone number really hack you? Nobody knows. But it seems unlikely. Just imagine you get threatened by someone telling you "I know your phone number". That's not a credible threat for anybody knowing anything about phones. Sounds like someone played you.
Another example of how a modified version of Kik messenger could be able to pose a security threat, is if it can by pass any upload file type restrictions. Some social media sites/apps have stopped or made some limitations on some types of file formats that can be uploaded or sent. This is because some file formats can be executable files that could contain malicious software that a non-tech savvy user may not realize.
A security threat, yes, but specifically a privacy threat is likely limited to finding out who lurks.
There are exploits that allow one user to break/brick a kik account of another user in a way that its no longer possible to use that account anymore for a given time which could be years. Basically banning someone forever. Other things like lagging and crashes are also possible.
Unfortunately all these things appear to be still possible.