Researchers with two security firms independently observed apps on the Google Play store that are stealing Facebook credentials, and one of the apps has been downloaded by up to a million Android users.
Cowboy Adventure is a working game by Tinker Studio that has between 500,000 and 1,000,000 downloads, but it is also malware – upon launching the app, certain users are met with a fraudulent Facebook login window that steals entered credentials and sends them to the attackers.
“If you have basic knowledge about OAuth, you should know that no [third] party could ask your [Facebook] account in this way,” a Wednesday post from security firm Trustlook said.
