Android Apps with 5.8 million Installs Stealing Facebook Passwords

[The_King]

Content source

https://thehackernews.com/2021/07/android-apps-with-58-million-installs.html

Google intervened to remove nine Android apps downloaded more than 5.8 million times from the company's Play Store after the apps were caught furtively stealing users' Facebook login credentials.

"The applications were fully functional, which was supposed to weaken the vigilance of potential victims. With that, to access all of the apps' functions and, allegedly, to disable in-app ads, users were prompted to log into their Facebook accounts," researchers from Dr. Web said. "The advertisements inside some of the apps were indeed present, and this maneuver was intended to further encourage Android device owners to perform the required actions."

The offending apps masked their malicious intent by disguising as photo-editing, optimizer, fitness, and astrology programs, only to trick victims into logging into their Facebook accounts and hijack the entered credentials via a piece of JavaScript code received from an adversary-controlled server

The list of apps are as follows -

• PIP Photo (>5,000,000 installs)
• Processing Photo (>500,000 installs)
• Rubbish Cleaner (>100,000 installs)
• Horoscope Daily (>100,000 installs)
• Inwell Fitness (>100,000 installs)
• App Lock Keep (50,000 installs)
• Lockit Master (5,000 installs)
• Horoscope Pi (>1,000 installs)
• App Lock Manager (10 installs)

In the last link of the attack, the stolen information was exfiltrated to the server using the trojanized applications.

 

[SumTingWong]

plot twist: the hacker is anti-facebook user so he just going to login to all those compromise accounts then delete them accounts. A hero we deserve but don't need.

 

[Brahman]

How do people find these apps to install it on their system....

 

[upnorth]

How do people find these apps to install it on their system....

I can't say conclusive it's what happened here, as I also haven't read everything deep enough, but many times malicious apps and software are propagated/advertised with something called SEO poisoning ( Search Engine Poisoning ).

Ubiquitous SEO Poisoning URLs

SEO poisoning, also known as search engine poisoning, is an attack method that involves creating web pages packed with trending keywords in an effort to trick search

www.zscaler.com

It's a cleaver way of getting search results higher up and seen faster.

 

[ForgottenSeer 85179]

plot twist: the hacker is anti-facebook user so he just going to login to all those compromise accounts then delete them accounts. A hero we deserve but don't need.

I don’t think he/ she is an Robin Hood even if it would be nice

 

[Thiagoo]

Sometimes i feel like the app verification system on Play Store is either very bad and lazy or nonexistent. Every single year i see a bunch of news like that

But like, it's not only Play Store verification that is bad, Android itself is way too insecure on my view, like still relying on outdated (and potentially vulnerable) libraries.

 

[CyberTech]

How do people find these apps to install it on their system....

This is android things its not safe...

 

[ForgottenSeer 85179]

This is android things its not safe...

Sorry for OT, but is your mobile configuration up2date? As it's from Nov 11, 2017

 

[CyberTech]

Sorry for OT, but is your mobile configuration up2date? As it's from Nov 11, 2017

Yes i know actually i'm too lazy to put the new one...