Android apps with 5.8 million installs caught stealing users’ Facebook passwords

[ad_1]

Google stepped in to remove nine Android apps that had been downloaded more than 5.8 million times from the company’s Play Store after apps were discovered surreptitiously stealing users’ Facebook login credentials.

“The apps were fully functional, and it was supposed to impair the vigilance of potential victims. With this, to gain access to all the functionality of the apps and, allegedly, to disable in-app ads, users were asked to log into their Facebook accounts,” researchers from Dr. Webb said. Within some of the apps already in place, this gambit was intended to further encourage Android device owners to perform the required actions.”

The offending apps masked their malicious intent by masquerading as photo editing, trash cleaner, fitness and astrology programs, only to trick victims into logging into their Facebook accounts and hijacking credentials entered via a piece of JavaScript code received by an adversary server.

The list of applications is as follows –

PIP Image (> 5,000,000 installs) Image Processing (> 500,000 installs) Garbage Cleaner (> 100,000 installs) Horoscope Daily (> 100,000 installs) Inwell Fitness (> 100,000 installs) App Lock Keep (50,000 installs) Lockit Master (5,000 installs) Horoscope Pi (>1,000 installs) App Lock Manager (10 installs)

In the last link of the attack, the stolen information was transmitted to the server using Trojan applications.

While this specific campaign appears to have set its sights on Facebook accounts, web researchers warned that this attack could have been easily expanded to load the login page of any legitimate web service with the goal of stealing logins and passwords from any platform.

The latest disclosure comes days after Google announced new measures for the Play Store, including requiring developer accounts to turn on two-step verification (2SV), provide an address, and verify their contact details as part of its ongoing efforts to combat scams and scams. Developer accounts.

If anything, development is another reminder that users are better off installing apps from well-known and trusted developers, watch out for permissions that apps ask for, as well as pay attention to other users’ reviews before installing.

.

[ad_2]