Google Play Apps Found to Have Trojans That Steal Facebook Logins and Passwords

Isabella James, Tech Times 02 July 2021, 11:07 pm

Nine Google Play apps have been found to have trojans in them that steal their users' Facebook logins and passwords.

This is according to the malware analysts of Dr. Web, an anti-virus software company. The discovery has been posted on Dr. Web's official website.

Per Dr. Web, the findings of their analysts have already been reported to Google, but only some apps have been removed from Google Play. "At the time of this news release, some apps were still available for download," according to the statement.

Google Play Apps Stealing Facebook Logins and Passwords

(Photo: Google Play Store)

Google Play hosted nine of the ten malicious apps found to have been stealing Facebook logins and passwords prior to being informed by Dr. Web. These malicious apps are:

App Lock Keep - Downloaded at least 50,000 times and detected as Android.PWS.Facebook.13

App Lock Manager - Downloaded at least 10,000 times and detected as Android.PWS.Facebook.13

Horoscope Daily - Published by developer HscopeDaily momo and detected as Android.PWS.Facebook.13. App has been installed more than 100,000 times

Horoscope Pi - Has more than 1,000 installs and detected as Android.PWS.Facebook.13

Inwell Fitness - A fitness app with more than 100,000 installs and detected as Android.PWS.Facebook.14

Lockit Master - Downloaded at least 5,000 times and detected as Android.PWS.Facebook.13

PIP Photo - An image editing app that has over 5 million installs. Android.PWS.Facebook.17 and Android.PWS.Facebook.18 have been detected in the app.

Processing Photo - A photo-editing software installed over 500,000 times detected by Dr. Web as Android.PWS.Facebook.13

Rubbish Cleaner - An app meant to optimize Android performance that has been downloaded more than 100,000 and has been detected as Android.PWS.Facebook.13

A tenth app discovered to have the Trojan, EditorPhotoPip, was not available on Google Play.

How the Apps Steal Facebook Logins and Passwords

(Photo : Sora Shimazaki from Pexels)

According to a report by Ars Technica, these malicious apps appear as fully functioning applications and offer "users an option to disable in-app ads by logging into their Facebook accounts." Users are then presented with a Facebook login prompt that asks for their usernames and passwords.

The apps load JavaScript that directly steal the user's login credentials that are then passed to trojan applications. It is sent to the attackers' C&C servers after. The trojans also steal cookies from the current authorization session, according to Dr. Web.

Also Read: Enhance Your Mobile Security With the Top 5 Best Android Antivirus Apps