Citing US officials "familiar with a classified intelligence assessment," the newspaper said the app allows it to "track every conversation, movement, relationship, appointment, sound and image of those who install it on their phones."
The app has topped charts in the UAE and boasts users from Europe, the US and the wider Middle East, among other regions and countries.
Read more: Russia-based FaceApp goes viral, gets a closer look
In the UAE, most Voice over Internet Protocol (VoIP) apps are banned, including the likes of WhatsApp and Skype. That made ToTok an attractive alternative for users in the UAE.
The app was pulled from Apple and Google's app stores.
ToTok issued a statement on Sunday saying that its app was "temporarily unavailable in these two stores due to a technical issue."
It said the app was still operational for users with Samsung, Huawei and Xiaomi phones, among others.
Read more: Germany debates stepping up active cyberoperations
Easy 'mass surveillance'Patrick Wardle, a cybersecurity researcher approached by NYT, published a technical analysis before the report under the headline: "Mass Surveillance, is an (un)Complicated Business."
Wardle said his technical analysis "showed the ToTok simply does what it claims to do … and really nothing more."
"Assuming the claims that ToTok is actual designed to spy on its users, this 'legitimate' functionality of the app is really the genius of the whole mass surveillance operation: no exploits, no back doors, no malware," he wrote.
"Again, just 'legitimate' functionality that likely afforded in-depth insight in a large percentage of the country's population."
Read more: Germany struggles to step up cyberdefense
Every evening, DW's editors send out a selection of the day's hard news and quality feature journalism. You can sign up to receive it directly here.