Nine photo editing and app-lock Android applications found stealing Facebook passwords

A number of Android apps – with over 5.8 million cumulative downloads – were found stealing Facebook passwords, a latest study by Doctor Web, a security firm, has revealed. According to a report in Business Insider India, the firm said nine apps that offered photo editing and app-lock features were found stealing passwords from users.Google Play Store had removed only a few of these apps by the time Doctor Web published its study on 1 July. However, by 5 July, all nine apps were removed by Google.[caption id="attachment_6197141" align="alignnone" width="1280"] It is recommended that Facebook users who downloaded these apps should change their passwords.[/caption]Out of these apps which have total downloads of 5.8 million, as many as five million downloads were of the app PIP Photo App. The other 0.8 million downloads were of the following apps: Rubbish Cleaner, App Lock Keep, Inwell Fitness, App Lock Manager, Lockit Master, Horoscope Daily, Horoscope Pi, and Processing Photo.Arstechnica reports that Google has banned the developers of these apps, which means they cannot submit any new apps to the Play Store.It has been recommended that Facebook users who downloaded these apps should change their passwords for security purposes.As per the publication, the apps allowed users to unlock more features and disable in-app advertisements when they logged in through their Facebook credentials.The app used to load the https://www.facebook.com/login.php page into WebView after it received the required settings from one of the C&C servers. The JavaScript that was received from the C&C server was loaded into the same WebView and the entered login credentials were hijacked using the same script. The stolen login credentials were then passed to the trojan applications using the methods provided through the JavascriptInterface annotation.