Facebook Warns 1 Million Users About Usernames, Passwords Stolen via 400 Malicious Apps

Apple said 45 of the 400 problematic apps were on its App Store and have been removed, while Google removed all the malicious apps in question.

By Jack Gillum, Bloomberg | Updated: 8 October 2022 10:48 IST

Facebook Warns 1 Million Users About Usernames, Passwords Stolen via 400 Malicious Apps

Photo Credit: Reuters

The apps worked by disguising themselves as photo editors, mobile games, or health trackers

Highlights

Google has removed all of these apps from the Play Store
Not all 1 million people necessarily had their passwords compromised
Meta would be sharing tips with victims to prevent this from recurring

Meta said it would notify roughly 1 million Facebook users that their account credentials may have been compromised due to security issues with apps downloaded from Apple and Alphabet's software stores. The company announced Friday that it identified more than 400 malicious Android and iOS apps this year that target internet users in order to steal their login information. Meta said it informed both Apple and Google about the issue in order to facilitate the removal of the apps.

The apps worked by disguising themselves as photo editors, mobile games, or health trackers, Facebook said.

Apple said 45 of the 400 problematic apps were on its App Store and have been removed. Google removed all the malicious apps in question, a spokesperson said.

Facebook to Customise User Feed, Asks Users for Help to Improve Algorithms

“Cybercriminals know how popular these types of apps are, and they'll use similar themes to trick people and steal their accounts and information,” said David Agranovich, director of global threat disruption at Meta. “If an app is promising something too good to be true, like unreleased features for another platform or social media site, chances are that it has ulterior motives.”

A typical scam would unfold, for example, after a user downloaded one of the malicious apps. The app would require a Facebook login to work beyond basic functionality, thus tricking the user into providing their username and password. Users could then, for example, upload an edited photo to their Facebook account. But in the process, they unknowingly compromised their account by giving the author of the app access.

Meta said it would be sharing tips with potential victims on how they can avoid being “re-compromised” by learning how to better spot problematic apps that pilfer credentials, whether for Facebook or other accounts. The malicious activity occurred off Meta systems, Agranovich said, adding that not all 1 million people necessarily had their passwords compromised.

Meta Users in the US Get NFT-Sharing Feature on Facebook, Instagram

5G is here. Should you buy a 4G phone? We discuss this on Orbital, the Gadgets 360 podcast. Orbital is available on Spotify, Gaana, JioSaavn, Google Podcasts, Apple Podcasts, Amazon Music and wherever you get your podcasts.

Affiliate links may be automatically generated - see our ethics statement for details.

Comments

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.