Loading story…
Multiple malicious Android apps distributed through Google Play were identified stealing Facebook credentials and session data from users. Researchers linked the activity to the Facestealer malware family and said the apps presented Facebook’s legitimate login page inside an Android WebView, where injected JavaScript captured usernames, passwords, user-agent strings, and cookies before sending the data to attacker-controlled infrastructure. One analyzed sample, com.friendtrip.smartscanner, contacted webtrace[.]club for configuration data and exfiltrated stolen information to an API endpoint on the same domain.
The campaign highlights a broader wave of Android applications built to harvest Facebook logins, with multiple Facestealer-tagged packages reportedly discovered and later removed from the Play Store. Security reporting warned users to stay alert for Facebook credential-stealing apps on Android, as the malware’s use of legitimate-looking login flows and stolen session artifacts could enable account takeover even beyond simple password theft.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Trend Micro reported a cluster of more than 40 fake cryptocurrency miner apps on Google Play, including Cryptomining Farm Your own Coin, that tricked users into entering wallet private keys and mnemonic phrases. The apps acted as wrappers for fraudulent mining websites, and researchers found the secrets were transmitted in plaintext to attacker-controlled servers; Google had removed the cited app by the time of writing.
Pradeo reported that the Google Play app Craftsart Cartoon Photo Tools was trojanized with Facestealer and had been installed more than 100,000 times. The app masqueraded as a photo editor, redirected users to a legitimate Facebook login page, and used injected JavaScript to steal credentials and Facebook account data; Pradeo said it alerted Google, but the app was still available as of Monday.
Analysis of the sample com.friendtrip.smartscanner showed it loaded Facebook's legitimate login page in an Android WebView, injected malicious JavaScript, captured usernames, passwords, user-agent strings, and cookies, then contacted webtrace[.]club for configuration and exfiltration.
A cluster of Android applications associated with the Facestealer malware family was identified on Google Play. The apps were designed to steal Facebook credentials and related session data, and the article states they have since been removed from the store.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 23 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
blog.pradeo.com
Open sourcetrendmicro.com
Open sourcethreatpost.com
Open sourceblogs.quickheal.com
Open sourcelabs.k7computing.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Netskope Threat Labs identified a Python-based **NodeStealer** variant that expands the malware from a browser and Facebook-focused information stealer into a spyware platform. The updated malware persistently logs keystrokes, monitors clipboard contents, captures screenshots during execution, and steals Wi-Fi passwords and files from victims’ Pictures directories, alongside browser credentials, cookies, payment-card data, and Facebook account information. Activity observed in August primarily affected targets in Asia and North America, with financial services the most affected sector. NodeStealer now queries more than 20 Facebook Graph API endpoints—up from two—to collect identity, social-network, content, advertising, commerce, and account-security data. It uses a split Telegram bot infrastructure for command-and-control and data exfiltration, enabling theft of Facebook Ads Manager assets that could support account takeover, fraud, impersonation, and misuse of business advertising accounts. Samples were distributed as compiled Python 3.12+ bytecode with altered header metadata, a technique that may hinder automated analysis and compilation-timeline assessment; researchers also found signs of possible LLM-assisted code development.
Sep 5, 2026
Two separate Android-focused threat operations were reported, both relying on social engineering to drive manual installation of malicious apps. Bitdefender documented a campaign that abuses **Hugging Face** as a trusted hosting/CDN distribution point for an Android credential-stealing payload targeting popular financial and payment services. Victims are lured into installing a dropper app named **TrustBastion** via scareware-style ads; after installation it displays a fake Google Play “mandatory update” flow, then contacts infrastructure associated with `trustbastion[.]com` which redirects to a Hugging Face dataset repository hosting the final APK. The actor used **server-side polymorphism** to generate new payload variants roughly every 15 minutes, resulting in thousands of variants and rapid repository churn (reported as >6,000 commits over ~29 days); after takedown, the operation reportedly resurfaced under a new name (“**Premium Club**”) with refreshed branding. ESET separately identified an Android spyware campaign tracked as **GhostChat** that uses **romance-scam** tactics to target individuals in Pakistan. The malicious app is disguised as a chat/dating service but primarily functions as a surveillance tool; it presents “locked” female profiles with passcodes (hardcoded in the app) to create a sense of exclusivity, then routes victims into WhatsApp chats tied to Pakistani numbers likely controlled by the operator. The app was distributed via unofficial sources (not Google Play) and is blocked by Google Play Protect by default; ESET also linked the same actor to a broader surveillance effort including a **ClickFix** compromise chain and a WhatsApp device-linking attack, using websites impersonating Pakistani government organizations as lures.
Jun 29, 2026
Attackers have been running an Android malware campaign against customers of eight Malaysian banks by posing as local businesses, including cleaning services and a pet store, through fake e-commerce websites promoted with Facebook ads and lookalike domains. Victims who click bogus Google Play download buttons on the copycat sites receive malicious Android apps hosted on attacker-controlled servers rather than the official app store. The malware steals online banking credentials by presenting a fake **FPX** payment page and then intercepts two-factor authentication by forwarding all incoming SMS messages to the attackers. ESET linked several of the malicious apps to the same threat actor through shared code and said the operation, first spotted in late 2021, was still active with newly registered distribution domains.
Aug 14, 2026