Phần mềm độc hại đánh cắp mật khẩu bị lây nhiễm nhiều hơn 100,000 người dùng thông qua Cửa hàng Google Play
Security specialists from Pradeo discovered password-stealing malware in the official Google Play Store app store.
The malware masquerades as the Craftsart Cartoon Photo Tools app and has been installed over 100,000 lần.
The dangerous app prompted users to upload their photos and other images in order to visually stylize them with cartoonish graphics. Trong thực tế, Craftsart Cartoon Photo Tools contains the FaceStealer trojan, which displays the Facebook login screen and requires users to log into an account before they can start.
If the user does not notice the trick and indeed enters his username and password, the application sends them to the attackers’ control server at zutuu[.]thông tin (VirusTotal). Ngoài ra, the malware binds to a URL at www.dozenorms[.]club (VirusTotal), where it sends additional data about the system. This address has already been used for other malicious applications containing FaceStealer.
After entering the Facebook credentials, nothing interesting happens: the application simply uploads the custom image to the color.photofuneditor.com online editor, which applies the desired graphic filter to it. The result will be displayed in the application, and it can be downloaded or sent to friends.
Dựa theo Pradeo analysts, the author of the app seems to have automated the repackaging process and injected only a small piece of malicious code into a legitimate app. These tricks helped him to bypass the Google Play Store verification process.
Let me remind you that we wrote that TeaBot Malware Infiltrates Google Play Store Again, và đó cũng là Experts discovered Xenomorph malware in the Google Play Store.
