Malicious actors have created an Android app which carried with it a password stealer, and possibly - an identity and biometrics stealer, as "added value".
Discovered by researchers at security firm Praedo, the “Craftsart Cartoon Photo Tools” promised to “cartoonify” a photo, but inorder to do so, users needed to log into their Facebook account.
However whatever details users provided to the app, (which ironically did appear to sometimes do exactly what it promsied concerning catoonifying images) did not log them into Facebook, but was instead sent to the app devs’ own command and control (C2) server.
We're looking at how our readers use VPNs with different devices so we can improve our content and offer better advice. This survey shouldn't take more than 60 seconds of your time. Thank you for taking part.
Safe sources, unsafe apps
What’s more, all of the images that people provide, do not get “cartoonified” on the endpoint itself, but are rather sent to a third-party server. Users have no way of knowing how long their images will reside on that server, what purpose they’ll server, and if the devs will sell it on the black market.
When Praedo's analysts first spotted the app on the Play Store, it had more than 100,000 downloads, and was still available for download. Google does now seem to have removed it in the meantime, as the message on the link now says “We're sorry, the requested URL was not found on this server.”
Micro apps, with limited functionality, that also carry malware or infostealers are quite popular among threat actors, as they allow them to bypass Google’s automated security gateways. Besides photo editors, QR code and barcode scanners are popular features that are often abused.
Google’s Play Store is perceived as a secure app repository, and people often lower their guard when downloading apps from that source. Security experts are warning that despite the source, users should be wary when downloading apps, double-checking app reviews other potential red flags.
"Craftsart Cartoon Photo Tools", for example, has had an average score of 1.7, and hundreds of negative comments.
- Here's our rundown of the best firewalls right now
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.