Android Apps Stealing FB Passwords

Google intervened to remove nine Android apps downloaded more than 5.8 million times from the company’s Play Store after the apps were caught furtively stealing users’ Facebook login credentials.

The offending apps masked their malicious intent by disguising as photo-editing, optimizer, fitness, and astrology programs, only to trick victims into logging into their Facebook accounts and hijack the entered credentials via a piece of JavaScript code received from an adversary-controlled server.

The list of apps are as follows –

• PIP Photo (>5,000,000 installs)
• Processing Photo (>500,000 installs)
• Rubbish Cleaner (>100,000 installs)
• Horoscope Daily (>100,000 installs)
• Inwell Fitness (>100,000 installs)
• App Lock Keep (50,000 installs)
• Lockit Master (5,000 installs)
• Horoscope Pi (>1,000 installs)
• App Lock Manager (10 installs)

In the last link of the attack, the stolen information was exfiltrated to the server using the trojanized applications.

While this specific campaign appears to have set its sights on Facebook accounts, Researchers cautioned that this attack could have been easily expanded to load the login page of any legitimate web platform with the goal of stealing logins and passwords from a variety of services.

Recently Google announced new measures for the Play Store, including requiring developer accounts to turn on 2-Step Verification (2SV), provide an address, and verify their contact details as part of its ongoing efforts to combat scams and fraudulent developer accounts.