Thursday, March 28, 2024

Beware!! 5.8 Million Times Downloaded Android App Steals Facebook Passwords

It seems that the drastic wave of cyberattacks has not yet properly able to teach the users to develop their security habits. As there are many users who still use the common and compromised credentials on several services and apps.

Now many of you might be thinking, Why? It’s convenient to use the same credentials on multiple apps and services, as in this case you don’t have to remember different credentials for different services and apps.

And here comes the key roleplay of hackers; they mainly target users’ primary social network accounts credentials, through which they map to hack other accounts using those same credentials.

Usage of apps has seen dramatic heights, since nowadays it is normal to download apps for almost all daily tasks like for online shopping, social networking, email, editing, banking, etc.

Apps Request Access to Facebook

Security analysts of Doctor Web have made a security analysis on these apps, and during their investigation, they identified 10 malicious applications on Google Play that have stolen Facebook credentials of all their users.

But, if we talk about security and privacy? Then let me clarify that not all the apps are secure, since there are many that ask for access to the Facebook account or even in some cases ask the users to put their Facebook credentials.

New Technique to Steal Facebook Credentials

To steal Facebook credentials the cybercriminals used trojans, and they do so while user creates their profile in apps by linking their Facebook account.

Apart from this, they also steal the Facebook credentials by luring the users, and here, they offer ad-free UI in exchange for access to the Facebook account. As in most cases, users agree with their terms to remove the annoying ads by linking their Facebook account.

The operators of these malicious apps simply execute their operation by loading malicious Javascripts that are capable of stealing the users’ Facebook login credentials.

Once they capture the credentials, the malicious script sent those details to the server controlled by the threat actors. And the operators of these apps load the legitimate Facebook web page “www[.]facebook[.]com/login[.]php” into WebView.

Not only that, even the experts have also claimed that the trojans used by the threat actors offer equal abilities to steal current authorization session cookies.

List of apps

Below we have mentioned all the malicious apps with all their key details:-

  1. App Lock Keep, from Sheralaw Rence with more than 50,000 downloads and detected as Android.PWS.Facebook.13.
  2. App Lock Manager, from Implummet col with more than 10,000 downloads and detected as Android.PWS.Facebook.13.
  3. Lockit Master, from Enali mchicolo with more than 5,000 downloads and detected as Android.PWS.Facebook.13.
  4. Horoscope Daily, from HscopeDaily momo with more than 100,000 downloads and detected as Android.PWS.Facebook.13.
  5. Horoscope Pi, from Talleyr Shauna with more than 1,000 downloads and detected as Android.PWS.Facebook.13.
  6. Inwell Fitness, from Reuben Germaine with more than 100,000 downloads and detected as Android.PWS.Facebook.14.
  7. PIP Photo, from Lillians with more than 5 million downloads and detected as Android.PWS.Facebook.17 and Android.PWS.Facebook.18, since it has several versions.
  8. Processing Photo, from chikumburahamilton with more than 500,000 downloads, and detected as Android.PWS.Facebook.13.
  9. Rubbish Cleaner, from SNT.rbcl with more than 100,000 downloads and detected as Android.PWS.Facebook.13.
  10. EditorPhotoPip, this is app is removed by Google from Google Play, and it’s detected as Android.PWS.Facebook.15.

Google’s Response & Recommendation

After identifying these apps the security expert of Doctor Web immediately notified Google about these apps. So, in terms of response, we must say that Google was quick to take action against these malicious apps.

As after getting notified, Google removed all these malicious applications from the Google Play Store, but, the fact is that this action would not fix the issue completely.

This problem will remain the same for the users who have already installed these apps and using them on their Android devices.

So, in this case, the experts have strongly recommended all the users to uninstall or remove all these malicious apps from their devices in case if they installed these applications.

And not only that, even they have also recommended the users to immediately change their Facebook login credentials, or else their accounts will be abused.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles