Android, a malware app with 100,000 downloads removed from the Play Store

Removed from Play Store Android l’app Craftsart Cartoon Photo Toolswhich contained a malware trojan which aimed to steal users’ Facebook credentials. Beyond 100 thousand people had downloaded the app before removal.

Removed malware app from Android Play Store Craftsart Cartoon Photo Tools

L’app Craftsart Cartoon Photo Tools allowed you to apply some nice effects to your photos, transforming the subjects into drawings and cartoons. However, the first time you download the app he asked for access to Facebook to be able to use the tools, without even proposing a registration on their servers.

Once the account was linked, the Trojan in the app copied the account information and sent it to servers in Russia. This way hackers could log into your Facebook account for discover searches, conversations, phone numbers. And potentially also the details of the payment cards (which should still be protected).

Researchers of Pradeo they found that the information came to a domain registered in Russia, which had been active for seven years and also used in the past for similar apps, each time removed from the Play Store. In fact, hackers often modify malware applications just enough to pass the automatic checks of the Play Store. Sooner or later Google finds out, but sometimes I manage to stay online long enough to steal information from many users.

Pradeo researchers explain “On some occasions we have even come across cases in which evildoers had developed a system for recompiling apps. fully automated“.

The app in this case contained the trojan named Facestealer: if you find the app on an alternative store to the Google one, do not download it.