- Joined
- Jun 28, 2020
- Messages
- 6,777
- Reaction score
- 726
- Points
- 212
- Awards
- 2
It's all fun and games until someone's password gets stolen. Security company ESET recently discovered that two popular games for Android gadgets were actually stealing users' Facebook login credentials the whole time. If you downloaded Cowboy Adventure or Jump Chess to your Android gadget, it's time to change your Facebook password.
Cowboy Adventure had been downloaded as many as 1 million times before Google removed it from the Play Store. Jump Chess had picked up several thousand downloads before it got the boot, according to CNN.
The apps worked by creating a fake Facebook login page that asked for a user's phone number or email address and password. It's unclear whether the people behind the scam actually created the apps or just hijacked them to trick victims. The app also spread by spamming victims' contact lists and social media accounts.
Trustwave security boffin Tian Fang also reported the malware pointing out that the login scam attacked users outside of the US and Canada, and should have sounded alarms for users familiar with OAuth's signing requirements.
Even though it appears the attack affected users outside the U.S., you should still get rid of it immediately and update your login information on Facebook to be safe.
Cowboy Adventure had been downloaded as many as 1 million times before Google removed it from the Play Store. Jump Chess had picked up several thousand downloads before it got the boot, according to CNN.
The apps worked by creating a fake Facebook login page that asked for a user's phone number or email address and password. It's unclear whether the people behind the scam actually created the apps or just hijacked them to trick victims. The app also spread by spamming victims' contact lists and social media accounts.
Trustwave security boffin Tian Fang also reported the malware pointing out that the login scam attacked users outside of the US and Canada, and should have sounded alarms for users familiar with OAuth's signing requirements.
Even though it appears the attack affected users outside the U.S., you should still get rid of it immediately and update your login information on Facebook to be safe.