Google Removes 25 Android Apps Caught Stealing Facebook Credentials: Evina

Google is claimed to have eliminated 25 apps from its Google Play retailer that had been caught stealing Facebook credentials. According to the French cyber-security agency, Evina, these malicious apps collectively had over 25 lakh downloads. The apps reportedly provided completely different functionalities, although they used the identical technique for extracting customers’ credentials. Some of the apps had been obtainable on the Google Play retailer for over two years earlier than they had been lastly eliminated, the cyber-security agency highlighted.

The findings had been revealed in a blog post by Evina and had been first reported by ZDNet. Google eliminated the apps earlier in June after the cyber-security agency reported its potential risk in May this 12 months. Most of those malicious apps provided new wallpapers, whereas others offered video enhancing instruments and flashlight instruments. Apps equivalent to Super Wallpapers Flashlight and Padenatef had over 5 lakh downloads every on Google Play.

How did the apps steal Facebook credentials?

According to Evina, as soon as the consumer launched the contentious app on their smartphone, the malicious app detected what app a consumer not too long ago opened and had within the telephone’s foreground. “If it is a Facebook application, the malware will launch a browser that loads Facebook at the same time. The browser is displayed in the foreground which makes you think that the application launched it,” the cyber-security agency explains.

Once the consumer put their Facebook login particulars on the phishing web page (which includes a black bar as an alternative of a blue bar of the unique Facebook app), the malicious then despatched the credentials to a distant server. This may doubtlessly enable attackers to entry all information saved on the Facebook account and even enable them to entry different web sites the place customers’ have logged in through their Facebook account.

Evina, nevertheless, has not clarified how these malicious apps prevented detection by Google’s Play Protection service. The full listing of those malicious Android apps is listed on Evina’s website.

ZDNet citing the cyber-security agency notes that all the 25 malicious apps had been developed by a single risk group.

In 2020, will WhatsApp get the killer function that each Indian is ready for? We mentioned this on Orbital, our weekly expertise podcast, which you’ll subscribe to through Apple Podcasts or RSS, download the episode, or simply hit the play button beneath.