More than 300,000 users across 71 countries have been victimized by a new Android threat campaign called the Schoolyard Bully Trojan.
Mainly designed to steal Facebook credentials, the malware is camouflaged as legitimate education-themed applications to lure unsuspecting users into downloading them.
The apps, which were available for download from the official Google Play Store, have now been taken down. That said, they still continue to be available on third-party app stores.
“This trojan uses JavaScript injection to steal the Facebook credentials,” Zimperium researchers Nipun Gupta and Aazim Bill SE Yaswant said in a report shared with The Hacker News.
It achieves this by launching Facebook’s login page in a WebView, which also embeds within it malicious JavasCript code to exfiltrate the user’s phone number, email address, and password to a configured command-and-control (C2) server.
The Schoolyard Bully Trojan further makes use of native libraries such as “libabc.so” so as to avoid detection by antivirus solutions.
While the malware singles out Vietnamese language applications, it has also been discovered in several other apps available in over 70 countries, underscoring the scale of the attacks.
The findings come more than a year after Zimperium unearthed similar activity aimed at compromising Facebook accounts through rogue Android apps as part of a campaign codenamed FlyTrap.
“Attackers can cause a lot of havoc by stealing Facebook passwords,” Richard Melick, director of mobile threat intelligence at Zimperium, said. “If they can impersonate someone from their legitimate Facebook account, it becomes extremely easy to phish friends and other contacts into sending money or sensitive information.”
“It’s also very concerning how many people reuse the same passwords. If an attacker steals someone’s Facebook password, there’s a high probability that same email and password will work with banking or financial apps, corporate accounts and so much more.”
