Malicious actors have created an Android app which carried with it a password stealer, and possibly - an identity and biometrics stealer, as "added value".
Discovered by researchers at security firm Praedo, the “Craftsart Cartoon Photo Tools” promised to “cartoonify” a photo, but inorder to do so, users needed to log into their Facebook account.
However whatever details users provided to the app, (which ironically did appear to sometimes do exactly what it promsied concerning catoonifying images) did not log them into Facebook, but was instead sent to the app devs’ own command and control (C2) server.
Safe sources, unsafe apps
What’s more, all of the images that people provide, do not get “cartoonified” on the endpoint itself, but are rather sent to a third-party server. Users have no way of knowing how long their images will reside on that server, what purpose they’ll server, and if the devs will sell it on the black market.
When Praedo's analysts first spotted the app on the Play Store, it had more than 100,000 downloads, and was still available for download. Google does now seem to have removed it in the meantime, as the message on the link now says “We're sorry, the requested URL was not found on this server.”
Micro apps, with limited functionality, that also carry malware or infostealers are quite popular among threat actors, as they allow them to bypass Google’s automated security gateways. Besides photo editors, QR code and barcode scanners are popular features that are often abused.
Google’s Play Store is perceived as a secure app repository, and people often lower their guard when downloading apps from that source. Security experts are warning that despite the source, users should be wary when downloading apps, double-checking app reviews other potential red flags.
"Craftsart Cartoon Photo Tools", for example, has had an average score of 1.7, and hundreds of negative comments.
- Here's our rundown of the best firewalls right now
Via: BleepingComputer