Facebook Password Stealing Apps Works Life On Android Play Store

Even after many efforts made past times Google final year, malicious apps ever somehow contend to brand their ways into Google app store.

Security researchers accept at nowadays discovered a novel slice of malware, dubbed GhostTeam, inward at to the lowest degree 56 applications on Google Play Store that is designed to pocket Facebook login credentials as well as aggressively display pop-up advertisements to users.

Discovered independently past times 2 cybersecurity firms, Trend Micro as well as Avast, the malicious apps disguise equally diverse utility (such equally the flashlight, QR code scanner, as well as compass), performance-boosting (like file-transfer as well as cleaner), entertainment, lifestyle as well as video downloader apps.

Like most malware apps, these Android apps themselves don’t comprise whatever malicious code, which is why they managed to terminate upwards on Google's official Play Store.

Once installed, it get-go confirms if the device is non an emulator or a virtual environs as well as thus accordingly downloads the malware payload, which prompts the victim to approve device administrator permissions to arrive at persistence on the device.

"The downloader app collects information nigh the device, such equally unique device ID, location, linguistic communication as well as display parameters," Avast said. "The device’s place is obtained from the IP address that is used when contacting online services that offering geolocation information for IPs."

How Android Malware Steals Your Facebook Account Password

As presently equally users opened upwards their Facebook app, the malware right away prompts them to re-verify their concern human relationship past times logging into Facebook. Instead of exploiting whatever organisation or application vulnerabilities, the malware uses a classic phishing system inward social club to acquire the labor done.

These mistaken apps only launch a WebView part amongst Facebook look-alike login page as well as inquire users to log-in. Apparently, WebView code steals the victim's Facebook username as well as password as well as sends them to a remote hacker-controlled server.

"This is most probable due to developers using embedded spider web browsers (WebView, WebChromeClient) inward their apps, instead of opening the webpage inward a browser," Avast said.

Trend Micro researchers warn that these stolen Facebook credentials tin give the sack subsequently live on repurposed to deliver "far to a greater extent than damaging malware" or "amass a zombie social media army" to spread mistaken intelligence or generate cryptocurrency-mining malware.

Stolen Facebook accounts tin give the sack equally good expose "a wealth of other fiscal as well as personally identifiable information," which tin give the sack thus live on sold inward the hole-and-corner markets.

Security firms believe that GhostTeam has been developed as well as uploaded to the Play Store past times a Vietnamese developer due to considerable usage of Vietnamese linguistic communication inward the code.

According to the researchers, the most users affected past times the GhostTeam malware reportedly resides inward India, Indonesia, Brazil, Vietnam, as well as the Philippines.

Besides stealing Facebook credentials, the GhostTeam malware equally good displays popular upwards adverts aggressively past times ever keeping the infected device awake past times showing unwanted ads inward the background.

All the apps accept since been removed past times Google from the Play Store after researchers reported them to the company. However, users who accept already installed ane such app on their devices should brand certain they accept Google Play Protect enabled.

Play Protect safety characteristic uses car learning as well as app usage analysis to take (i.e. uninstall) malicious apps from users Android smartphones inward an essay to forbid whatever farther harm.

Although malicious apps floating on the official app shop is a never-ending concern, the best means to protect yourself is ever to live on vigilant when downloading apps, as well as ever verify app permissions as well as reviews earlier yous download one.

Moreover, yous are strongly advised to buy the farm along a expert antivirus app on your mobile device that tin give the sack abide by as well as block such threat earlier they infect your device, as well as most importantly, ever buy the farm along your device as well as apps up-to-date.

Share This :