Facebook warns a million users of passwords stolen by malicious applications

Meta Platforms warned this Friday that one million users of Facebook they downloaded or used apparently innocuous mobile applications, but designed to steal their password to access the social network.

“We’re going to tell a million people who might have been exposed to these apps – which doesn’t necessarily mean they were hacked,” David Agranovich, a director of Meta’s cybersecurity teams, said during a news conference.

Since the beginning of the year, Meta, the parent company of Facebook and Instagramidentified more than 400 “malicious” applications, available for smartphones operated with iOS (Apple) y Android (Google).

“These applications were present in the Google Play Store and the App Store from Apple and posing as photo editing tools, gaming tools, VPN tools and other services,” Meta said in a statement.

Once downloaded and installed on the phone, these apps asked users for their Facebook credentials in order to use some features.

“They tried to encourage people to give their confidential information to allow hackers to access their accounts,” summarized Agranovich, who estimates that the developers of these applications were probably looking to recover other passwords, not just those of Facebook.

The goal seemed to be relatively indiscriminate,” he said. It was about “getting as many as possible” of passwords.

Meta stated that it has shared its findings with Apple and Google.

Apple did not respond to an AFP request for comment, but Google said it had removed most of the apps Meta flagged from its Play Store.

“None of the apps identified in the report are still available on Google Play,” a Google spokesperson wrote to AFP.

More than 40% of the applications indicated were used to edit images. Others were simple tools, to turn your cell phone into a flashlight, for example.

Agranovich advised users to be careful when an app asks for passwords without a valid reason or makes promises “too good to be true.”