Cybersecurity analysts have discovered ten different Android apps that surreptitiously pilfered user credentials, nine of which had managed to collectively clock over 5.8 million downloads on Google’s Play Store.
Malware analysts at security firm Doctor Web said that the apps masqueraded behind genuine use cases such as photo editing and framing, exercise and training, horoscopes, and removal of junk files from Android devices, and were fully functional.
The apps invited users to remove ads and access all their functions, simply by logging into their Facebook accounts, which is how they got hold of the login credentials.
As this would trigger automated Google Play security checks, the apps loaded the legitimate Facebook login page. However, they then continued to also load malicious JavaScript in the same space, which then hijacked the login credentials.
Booted off the store
The analysts believe the trick could have been used to steal logins and passwords from any service.
Parsing through the report, Ars Technica reports that the Dr.Web analysts identified five malware variants inside the apps. Three of these are native Android apps, while two used Google’s Flutter framework.
However, in the larger scheme of things, the researchers have lumped them all together as the same trojan since they use the same configuration file formats and JavaScript code to steal user data.
A Google spokesperson told Ars Technica that in addition to removing the offending apps, Google has also banned the developers of all nine apps from the platform.