Schoolyard Bully Trojan Steals Facebook Account Info

Researchers with Zimperium zLabs have uncovered an Android malware campaign referred to as the Schoolyard Bully Trojan, which has affected over 300,000 victims since 2018.

The malicious apps making up the constellation of Schoolyard Bully are disguised as educational applications containing various books and topics for their users to read. However, what is hidden underneath is code capable of stealing Facebook credentials. The malware was used to target primarily Vietnamese speakers, with a much smaller number of targets in as many as 71 other countries across the globe.

Facebook has an impressive user base of nearly 3 billion monthly users and remains the most popular social media platform. Unfortunately, hackers have been exploiting the Schoolyard Bully Trojan to access credentials without authorization. It is estimated that nearly 65% of people use the same password that was breached in a past incident. This high rate of recycled passwords explains why the Schoolyard Bully Trojan has been successful for so long.

The Trojan is capable of stealing a user's email and phone number, as well as password from their Facebook account. Real names and ID strings are also stolen.