Site icon TheCyberThrone

Schoolyard Bully Trojan Campaign

PravinKarthik
Advertisements

Facebook logins from over 300,000 users were stolen in a Trojan campaign lasting nearly four years. Dubbed as Schoolyard Bully, malware hidden in several applications available on both Google Play and third-party app stores.

This Trojan uses Java script injection to steal the Facebook credentials . The malware is designed to steal the email, phone number, Facebook password, ID, and name of its victims, and is hidden in benign-looking educational applications through a legitimate URL inside the WebView.

It uses native libraries to stay hidden from most AV and machine learning detection tools, and to store its C&C data.

Primarily focused on Vietnam, the long-running campaign has been infecting users in 71 countries since 2018. But the actual number of countries could be more than what was accounted for because the applications are still being found in third-party app stores.

Malicious applications continue to flourish in the Android ecosystem, despite Google’s best efforts to police the Play store. Though this application is removed from the official play store, its presence is still found in third party websites

Indicators of Compromise

C&C Servers

File hashes

Exit mobile version