Cybersecurity (opens in new tab) analysts have discovered ten different Android apps (opens in new tab) that surreptitiously pilfered user credentials, nine of which had managed to collectively clock over 5.8 million downloads on Google’s Play Store.
Malware (opens in new tab) analysts at security firm Doctor Web said (opens in new tab) that the apps masqueraded behind genuine use cases such as photo editing and framing, exercise and training, horoscopes, and removal of junk files from Android devices (opens in new tab), and were fully functional.
The apps invited users to remove ads and access all their functions, simply by logging into their Facebook accounts, which is how they got hold of the login credentials.
We're looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and you can also choose to enter the prize draw to win a $100 Amazon voucher or one of five 1-year ExpressVPN subscriptions.
>> Click here to start the survey in a new window (opens in new tab) <<
- Shield yourself with these best identity theft protection services (opens in new tab)
- Here's our choice of the best malware removal (opens in new tab) software on the market
- We've put together a list of the best endpoint protection (opens in new tab) software
Booted off the store
The analysts believe the trick could have been used to steal logins and passwords from any service.
Parsing through the report, Ars Technica reports (opens in new tab) that the Dr.Web (opens in new tab) analysts identified five malware variants inside the apps. Three of these are native Android apps, while two used Google’s Flutter framework.
A Google spokesperson told Ars Technica that in addition to removing the offending apps, Google has also banned the developers of all nine apps from the platform.
- Protect your devices with these best antivirus software (opens in new tab)