9 Android Apps Stealing Facebook Password Found On The Play Store!

Cybersecurity researchers discovered nine android apps stealing the Facebook passwords of their users. The apps were removed from the Play store in response to the password-stealing campaign. However, the users who downloaded the apps are still prone to the password-stealing campaign. 

Victim Of These Nine Apps Stealing Facebook Password:

The research didn’t reveal the attacks on any particular users belong to a specific geo location. However, It’s been said that more than 5,856,010 users have downloaded these apps stealing Facebook passwords from Google’s play store. 

List Of Apps Stealing Facebook Passwords On The Play Store:

Here are the nine apps Doctor Web found on the Play store. See your phone for these apps Immediately and remove them if installed. Most importantly, rest your Facebook password if you haven’t done it yet.

Fig #1: 9 apps stealing Facebook password

How Do These Apps Steal Facebook Passwords?

Attackers have used Android’s play store to launch the password-stealing campaign. Password stealer trojans were used as a harmless application to steal the Facebook password.

Fig #2: Prompting Facebook login

Fig #3: Loading Facebook login web form

Countermeasures:

When it comes to deal with any such password-stealing campaign, we would suggest you to do three basic things:

Identified Indicator Of Compromise (IOC) Apps Stealing Facebook Password:

IOCs indicators of compromise. If you found any of these files on your Android device, which has the corresponding SHA-1 hash, take the countermeasures without delay. Additionally, if you notice your Android phone has communicated to these URLs at any point in time, it’s clear that your phone is compromised. The verification process needs some technical knowledge to check the file fingerprints and communication with the URLs. You can leave this section if you are not from a technical background. We feel it’s our duty to give the details as much as we can.

IOCs:

URLs:

data.applockkeep.xyzshop.vfgrl.comwap.inwellfitness.xyzcc.horoscopemagic.xyzmxi.applockmaster.xyzmm.superbrightflashlight.xyzwap.lockitmaster.xyzdata.horoscopedaily.xyz

IPs:

108.160.132.1545.32.110.28

Thanks for reading this post. Please share this post to all android users and create a awareness about the apps stealing Facebook password and this password stealing campaign.