Trojan in an app and steal Facebook credentials: removed after 100,000 downloads

I was The app that was removed from the Play Store today Craftsart Cartoon Photo Tools: received a Trojans. The plot of the scam is well known: an app seemingly similar to others that promise to apply – and apply – cute effects to photos – but at the same time grabbed the Facebook login credentials and transferred to Russian servers.

Initially, Craftsart Cartoon Photo Tools was required to log in with Facebook, which is an excellent solution for quick switching to the application, avoiding wasting time with Recording that was not “accidentally” suggested. The credentials came into the possession of the attackers who in this way took control of the account and the information received, including Searches, chats, phone numbers and possibly payment cards. Maybe the solution Less “fine” than Escobar, another modern malware with a penchant for payment informationbut no less dangerous.

Radio researchers found that the cartoon tools from Kraftsart spoke with a The domain is registered in RussiaIt has been active for seven years and is also used by other apps that were discovered in the past as fraudulent and at the same time they were removed from the Play Store. Pradeo explains that developers often get deleted apps of this type They post it again after reformulating itin order to obtain a permanent source of supply for criminal activities: On some occasions – they write – We’ve also come across cases where the bad guys have developed a fully automated system for recompiling apps”, So as not to get your hands dirty.

Of course Kraftsart Cartoon Toolkit contains a file A Trojan named Facestealer No matter which default store you downloaded it from. The spyware was in the application code, so not only in the version uploaded to the Play Store, as it was chosen by more than 100,000 users: the advice, of course, is stay awayEven if you find it on a store other than the Play Store that hasn’t removed it yet.