Facebook Says 400 Malicious Apps Stole 1 Million Users’ Passwords: Details

Meta stated it could notify roughly 1 million Facebook customers that their account credentials might have been compromised on account of safety points with apps downloaded from Apple and Alphabet’s software program shops. The firm introduced Friday that it recognized greater than 400 malicious Android and iOS apps this yr that focus on web customers so as to steal their login info. Meta stated it knowledgeable each Apple and Google in regards to the problem so as to facilitate the elimination of the apps.

The apps labored by disguising themselves as photograph editors, cell video games, or well being trackers, Facebook stated.

Apple stated 45 of the 400 problematic apps had been on its App Store and have been eliminated. Google eliminated all of the malicious apps in query, a spokesperson stated.

“Cybercriminals know how popular these types of apps are, and they’ll use similar themes to trick people and steal their accounts and information,” stated David Agranovich, director of worldwide menace disruption at Meta. “If an app is promising something too good to be true, like unreleased features for another platform or social media site, chances are that it has ulterior motives.”

A typical rip-off would unfold, for instance, after a consumer downloaded one of many malicious apps. The app would require a Facebook login to work past fundamental performance, thus tricking the consumer into offering their username and password. Users might then, for instance, add an edited photograph to their Facebook account. But within the course of, they unknowingly compromised their account by giving the writer of the app entry.

Meta stated it could be sharing ideas with potential victims on how they will keep away from being “re-compromised” by studying tips on how to higher spot problematic apps that pilfer credentials, whether or not for Facebook or different accounts. The malicious exercise occurred off Meta programs, Agranovich stated, including that not all 1 million folks essentially had their passwords compromised.

© 2022 Bloomberg L.P.