A malicious cartoon rendering Android app that steals Facebook credentials was installed 100K+ times before it was removed from the Google Play Store
A malicious Android app that steals Facebook credentials has been installed over 100,000 times via the Google Play Store, with the app still available to download.
Context & Ripple Effects
Google Play has repeatedly removed Android apps that harvested Facebook logins, including 25 apps tied to more than 2.3 million downloads in 2020 and nine apps in 2021, one of which exceeded 5.8 million downloads. The cartoon-rendering app adds another lower-scale incident to a recurring enforcement pattern: credential theft can reach users through ordinary-looking Play listings before removal.
First-order effects
- More than 100,000 installs leave affected Android users exposed to Facebook credential theft even after the app's Play Store distribution is halted.
- Google Play must remove the listing and address a case in which a malicious app passed through its marketplace to a sizable user base.
Second-order effects
- The recurrence of Facebook-login theft across multiple removed app clusters raises the cost for Google Play's review and detection systems, while Facebook bears the account-security consequences of credentials collected through Android apps.
- For Android users, a Play Store listing is shown again not to be a sufficient trust signal for apps that request or imitate social-login flows.
Third-order effects
- If removals continue to follow large install counts, mobile-app security will shift toward preventing credential-harvesting apps from reaching the store rather than treating takedowns as the principal safeguard.
- The repeated targeting of Facebook credentials points to app-marketplace abuse becoming a durable account-security problem shared by platform operators and the services whose logins are phished.
The trend: Android marketplace enforcement is confronting a recurring pattern in which seemingly benign apps use Play distribution to harvest high-value social-account credentials before detection.