Google removes 25 Android apps caught stealing Facebook credentials

guest · Jun 30, 2020

Google removes 25 Android apps caught stealing Facebook credentials
The malicious apps were downloaded more than 2.34 million times
June 30, 2020
https://www.zdnet.com/article/google-removes-25-android-apps-caught-stealing-facebook-credentials/

Google has removed this month 25 Android applications from the Google Play Store that were caught stealing Facebook credentials.

The malicious apps were developed by the same threat group and despite offering different features, under the hood, all the apps worked the same.
According to a report from French cyber-security firm Evina shared with ZDNet today, the apps posed as step counters, image editors, video editors, wallpaper apps, flashlight applications, file managers, and mobile games.
Click to expand...

If the app was Facebook, the malicious app would overlay a web browser window on top of the official Facebook app and load a fake Facebook login page (see image below: blue bar = actual Facebook app, black bar = phishing page).

If users entered credentials on this phishing page, the malicious app would log the data and send it to a remote server located at (the now-defunct) airshop.pw domain.
Evina said it found the malicious code that stole Facebook credentials in 25 apps they reported to Google at the end of May.
Click to expand...

The full list of 25 apps, their names, and package ID, are listed below.
Click to expand...

Log in or Sign up

Google removes 25 Android apps caught stealing Facebook credentials

guest Guest

Log in or Sign up

Google removes 25 Android apps caught stealing Facebook credentials

guest Guest

Useful Searches