Both Apple and Google has struggled for years to keep malicious apps out of their official mobile app stores and away from users’ phones. Simple programs like flashlight apps, photo editing tools, and games can mask attempts to get user data, allow for fake charges, or steal login credentials to a service. legal. Today, Meta said it has found and reported more than 400 apps this year in official app stores set up to steal victims’ Facebook credentials.
Meta will notify 1 million users that they may have been exposed to one of the fake apps. That doesn’t mean all of those users have had their Facebook accounts compromised, but Meta researchers say they’re being cautious and looking for a wide net because they have limited visibility. out of their own platform to know exactly what happened to each user. Of the 400 programs flagged and reported by Meta, 45 are iOS apps. The company says that the activity does not appear to be targeted to a specific geographical area or a small group of people.
“It’s a space with many adversaries, and some of these applications manage to evade detection,” said David Agranovich, Director of Threat Disruption at Meta. “Flashlight app, photo editor, mobile game. There are plenty of legitimate apps on the Apple and Google stores, but cybercriminals know how popular these types of apps are and use them to their advantage. We want to stop the bullies and keep people safe.”
Agranovich said that this pool of 400 apps from 2022 only targets Facebook, not Instagram and WhatsApp, the company’s other popular platforms. But the company has Threats Tracked from similar credential-stealing apps that focus on those services.
Google Play and Apple’s App Store both have their own checking systems, but some Malicious apps still slide. Stealing credentials is a classic focus of the developers of these fake apps, and attackers often create their own ploys to take over high-value accounts like Facebook profiles, both both contain a lot of data and are also used as single sign-on platforms to sign in to other services. Nearly 47 percent of the apps that were flagged by Meta were posing as photo editing services. About 15 percent are said to be business utilities. And almost 12% pretend to be a VPN, while “phone gadgets”, games and lifestyle make up the rest of the categories.
Google said the Android apps that Meta identified had all been taken down from Google Play, and the company had independently captured and removed many of them during the year prior to Meta’s disclosure.
Apple says it does not tolerate fraudulent or malicious apps in the App Store, and 45 iOS apps that Meta researchers flagged have been removed.
Both companies have struggled to control their official app stores, and each has faced similar challenges. For Google, Android’s open ecosystem means users can download apps from third-party app stores outside of Google’s control. This makes matters even more problematic when malicious apps appear in Play, but it also gives users time to source apps where they want (ideally if they know that they can trust a particular developer). The closed iOS ecosystem is less of a threat from rogue apps outside of the App Store, but as a result, all users must download their apps from Apple, which makes stealthy attackers vulnerable. Their malicious application entry is even more valuable.
