Android App Containing Facestealer Trojan Taken Down from Play Store

Another month, another Android app takedown on the official Google Play Store. This time the offender was an application posing as an innocent photo manipulation app, while in reality, it contained dangerous malware that allowed hackers to take complete control over victims' Facebook profiles.

Photo manipulation app hides Facestealer malware

The app in question was named Craftsart Cartoon Photo Tools and claimed to offer users, or rather victims, the ability to turn photos into cartoons. Everyone loves a bit of goofy fun with their photo gallery, which is exactly why this malware-laden app was so successful.

According to researchers with French mobile security company Pradeo, the malicious app was downloaded a whopping 100,000 times before Google stepped in and removed it from the Play Store.

The scary thing about the app is not just the number of times it was downloaded before it was taken down. The more worrying part are the capabilities of the malware that was hidden in the app. The malicious photo tool was loaded with the Facestealer trojan. The name might give you an idea of what the trojan does even if you never heard of it before - it steals your Facebook account.

The damage caused by the malware might be significant, depending on what information was contained in the compromised Facebook account. The Facestealer malware can grab emails, real world addresses, and IPs, as well as phone numbers and even credit card details if those were entered and saved into the Facebook account. The trojan can also access and read all the victim's conversations using Facebook messages.

This is not the first time an innocent-looking app was carrying the Facestealer trojan. There have been other instances in the past where the exact same malicious payload was hidden in other apps that thankfully got fewer downloads.

Facestealer – a repeat offender

Like before, the malicious code containing Facestealer is just a very small piece of the full app. This allows the code to "hide" among legitimate clean code. As researchers pointed out, the app carrying the malware had real baseline photo manipulation functionality, to trick automated detection and users alike.

The fact that a malware-laced app containing dangerous trojans can remain on the Android Play Store long enough for 100,000 users to download it is disturbing, but it is not too clear what Google can do to improve its store security and police it better.