Google removes popular Android apps that stole Facebook passwords
 

Google is still racing to pull Android apps that commit major privacy violations. Ars Technicanotes that Google has removed nine apps from the Play Store after Dr. Web analysts discovered they were trojans stealing Facebook login details. These weren't obscure titles — the malware had over 5.8 million combined downloads and posed as easy-to-find titles like "Horoscope Daily" and "Rubbish Cleaner."

The apps tricked users by loading the real Facebook sign-in page, only to load JavaScript from a command and control server to "hijack" credentials and pass them along to the app (and thus the command server). They would also steal cookies from the authorization session. Facebook was the target in each case, but the creators could just have easily steered users toward other internet services.

https://www.engadget.com/google-remo...2.html?src=rss