Millions of Facebook users’ passwords may have been compromised no thanks to malicious third-party apps, warns social media giant Meta. The company’s security researchers have published a new report warning people about more than 400 scam apps that were designed to hijack Facebook passwords.
According to the report, these seemingly harmless apps were disguised as “fun or useful” services such as photo editors, camera apps, fitness tracking apps, VPN services, and more. These apps included an option to “Log in with Facebook” like many other apps to make it easy for you. However, these login features were just means to steal Facebook passwords.
Meta’s Director of Threat Disruption, David Agranovich added that most of these apps had little to no functionality of their own. During a briefing with reporters, he said:
Many of the apps provided little to no functionality before you logged in, and most provided no functionality even after a person agreed to login.
These malicious apps were available on Apple’s App Store as well as Google Play Store, but most of these were Android apps. The Android apps were mostly consumer apps like photo filters, but the 47 iOS apps, according to Meta, were “business utility” apps. Some of the names on the list were “Very Business Manager”, “Meta Business”, “FB Analytic”, “Ads Business Knowledge”, and more.
Meta was quick to share its findings with Apple and Google while also pushing warnings to 1 million people who may have used the apps. The notifications informed users that their Facebook account information may have been compromised.
Apple and Google have confirmed that all of these apps have been removed from their respective app stores. A Google spokesperson said in a statement:
All of the apps identified in the report are no longer available on Google Play. Users are also protected by Google Play Protect, which blocks these apps on Android.
