Malware analysts discovered nine Android apps on the Google Play Store with more than 5.8 million downloads that were sneakily stealing users' Facebook login credentials.
Russian anti-malware software company Dr.Web found trojan apps that would steal Facebook passwords by tricking unsuspecting victims into entering their private information in order to bypass in-app ads. Fortunately, these Android apps are no longer available on the Play Store.
- Best phone deals in July 2021
- Best budget phones in 2021
- iPhone and Android phones can permanently stop spam calls
Spotted by Ars Technica, the apps ranged from photo-editing software to fitness programs and horoscope news. One of the malicious apps known as "PIP Photo" had 5 million downloads, while others ranged from 10 to 500,000.
To trick users, the trojan apps would provide full functionality of their services and take away in-app ads if the users logged into their Facebook account via the application.
The app would load up a legitimate Facebook login page, but the details typed in would go straight to the malicious actors' command-and-control server. With the number of downloads, millions of Facebook accounts could have potentially been hacked into.
While the Android apps are no longer listed on the Play Store, it's still a good idea to check if they are lingering on your smartphone and delete them straight away. According to the report, Google has permanently banned the developers of the apps to prohibit them from making new apps.
Below is a list of the trojan apps:
- PIP Photo
- Processing Photo
- Rubbish Cleaner
- Inwell Fitness
- Horoscope Daily
- App Lock Keep
- Lockit Master
- Horoscope Pi
- App Lock Manager
During the investigation, Dr.Web analysts found an additional trojan app that had previously made its way onto the Google Play Store. Image editing software app EditorPhotoPip had already been removed but could be downloaded through aggregator websites.
The security report goes into further detail on how the hackers stole the Facebook user login credentials. For those who have downloaded these apps, it's best to change your Facebook password, along with any other application that may use the same login information.
Unfortunately, Android apps can be a huge cybersecurity risk. Earlier this year, cybersecurity researchers discovered 13 Android apps that potentially left over 100 million smartphone users and developers vulnerable to malicious attacks due to their private data being exposed.
If you're looking to be protected online and to hide your private information, you'll want to find out what a VPN is, and why you should be using one.
