Facebook’s parent company, Meta, has identified over 400 malicious Android and iOS apps that target people in order to steal their Facebook login information.
According to Meta, the app discoveries were all made in 2022 and findings have been reported to Apple and Google.
The malware apps are disguised as apps with fun or useful functionality. Once downloaded, these apps can steal a user’s login information by asking the user to ‘login with Facebook’ to access the app's features. Once the user has handed over their credentials, the malicious actor can potentially gain full access to an individual’s account, message their connections and access private information.
“We’ve shared our findings with industry peers, security researchers and policymakers to help us improve our collective defenses against this threat,” Meta said in a statement.
The company noted that this is a “highly adversarial space” and, while work is being done to remove the malicious software, some apps evade detection and make it onto legitimate app stores.
The apps were listed on the Google Play Store and Apple’s App Store disguised as photo editors, fames, VPN services, business apps and other utilities to trick people into downloading them. Meta highlighted some examples that included:
- Photo editors, including those that claim to allow you to “turn yourself into a cartoon”
- VPNs claiming to boost browsing speed or grant access to blocked content or websites
- Phone utilities such as flashlight apps that claim to brighten your phone’s flashlight
- Mobile games falsely promising high-quality 3D graphics
- Health and lifestyle apps such as horoscopes and fitness trackers
- Business or ad management apps claiming to provide hidden or unauthorized features not found in official apps by tech platforms
The most popular category identified was photo editors which accounted for 46.2% of the malicious apps identified. Game apps accounted for 11.7% and VPN apps were also 11.7%.