A Paris-based anti-fraud firm, Evina, has unmasked malware that executes java script to retrieve the login credentials of Facebook users around the globe which are then transmitted to a server.
Evina confirms that African users of the social platform are among those targeted.
The malware, discovered in collaboration with Evina’s clients, launches a browser that loads Facebook at the same time a mobile user is trying to open the platform.
By displaying in the foreground, the user believes the fraudulent browser is legitimate.
Malware and ransomware that targets hundreds of millions of mobile users worldwide can have devastating personal, productivity and financial consequences. It is of the utmost importance for individuals and companies alike that Evina remains vigilant against mobile malware.
“This new malware is particularly dangerous as it could effectively ruin your online and offline life by making off with the credentials of one of your most valued pieces of digital real estate,” says Evina CEO David Lotfi.
Worse still, it is embedded in a whole range of applications commonly available for app store download and these include everything from flashlight to wallpaper, pedometer, file manager and video maker apps.
Evina has successfully reverse-engineered the errant software. In addition, Evina informed Google about this new threat so others could also be protected.
“Fraudsters are everywhere,” says Lofti. “Let’s remember once again that victims are not culprits. The app developer, the app store and all other legitimate players involved are simply innocent victims of fraudsters and their malware.”