Facebook warns 1 million users about apps trying to compromise accounts

Facebook identified 400 apps across the Google Play and Apple App store that posed as harmless lifestyle and business services to dupe users.

Facebook will alert 1 million users on Friday that they may have unknowingly revealed login credentials to malicious Android or iOS apps.

The warning follows the release of Facebook parent company Meta’s first security report on malicious apps targeting login information. The report identifies 400 mobile applications across the Google Play and Apple App store that posed as harmless lifestyle and business apps to dupe users.

Once installed, the apps prompted users to “Login with Facebook” and enter their credentials. Doing so gives the attacker access to their Facebook account and potentially any other accounts that share the same login credentials. If an individual had two-factor authentication enabled they may have been asked by the threat actor to provide that code as well for access.

Because an account compromise happened through the malicious app, and not Facebook, the company is unable to say how many users were compromised. Instead, the company is relying on signals like on-platform behavior and how it correlates with behavior demonstrated by the malicious apps to determine which users will receive a notification.

“We’re being overcautious here,” David Agranovich, director of threat disruption, told reporters in a call. He noted that many of the apps didn’t just target Facebook credentials.

Facebook said it alerted Apple and Google to its findings prior to publishing the list of apps. Both companies told CyberScoop said that the apps flagged by Facebook had been removed from their respective stores.

Scammers appeared to be indiscriminate in their targeting, said Agranovich. Nearly half of the apps presented themselves as photo editing tools and many others as business apps such as VPNs with names like “Bamboo VPN” and “Free VPN Master.” Meta researchers also found one app that promised to make the flashlight on your phone brighter.

Only 46 apps uncovered by Facebook were iOS apps and nearly all of them claimed to offer advertising management tools for Facebook pages. Agranovitch said that scammers may have been looking for access to accounts’ pages or advertising accounts to further perpetuate scams.

Alongside the alert, Facebook is offering tips to users on how to differentiate bogus apps from legitimate ones. That includes looking for negative reviews and low downloads and questioning why an app would be asking for Facebook permissions in the first place.

What makes these particular scams tricky is that they follow users across platforms — from an app store to a mobile device to Facebook. That means no individual platform gets the full picture of the fraudsters’ activities.

“Hopefully, that notification will give them pause when they encounter a suspicious login attempt,” said Agranovich. “Many of these applications don’t just target Facebook credentials, they target credentials across a variety of different internet services.”

Facebook has gone after scammers in the past by suing hosting companies that hosted spammy URLs posing as the company.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure