There are thousands of apps in the Google Play Store for everyone to download and use, but what! A big tree must have dead branches, and there are naturally a lot of mouse droppings with ulterior motives hidden inside. People must be careful at all times to prevent being fooled. Google has removed nine apps that used popular features to gain your trust and then steal your Facebook password.
Google removes 9 apps that secretly stole Facebook passwords, downloaded more than 5.8 million times
According to foreign security research units Dr. Web’s latest reportThe article pointed out that in order to gain user trust and reduce alertness, these 9 apps provide full-featured services, including photo editing, exercise, astrology, and removal of junk files on Android. These applications all provide users with the option to log in to their Facebook account to use in-app ads. When you select this option, you will see a real Facebook login interface, requiring you to enter your username and password. The problem is that on this page, unscrupulous people will use JavaScript from the C & C server to overlay and load another layer, which is directly used to intercept the login credentials you enter.
Analysis of the malware showed that they all received settings designed to steal Facebook account login names and passwords. However, an attacker could easily change the Trojan’s settings and command them to load another legitimate service’s web page, or even use a completely fake login form on a phishing website, making the Trojan capable of stealing logins and passwords for any service.
Researchers discovered five malware variants hidden within these apps, three of which were native Android apps and the remaining two using Google’s Flutter framework designed for cross-platform compatibility. Dr. Web noted that it classifies all of these Trojans as the same Trojan because they use the same profile format and the same JavaScript code to steal user data.
Now, these apps have been removed from Google Play, and the company has also banned the developers of these nine apps from using its app store, which means that they will not be allowed to submit new app applications. While Google is doing the right thing, this is only a small hurdle for developers, as they only have to pay a one-time fee of $25 to sign up for a new developer account under a different name.
◎Data source:Ars Technica
Source: KOCPC Chinese