Facebook owner says 1 million users may have had passwords stolen by suspicious apps

The company Meta warned this Friday (07) that one million Facebook users have downloaded or used applications that appear to be harmless at first, but are created to steal your password to access the social network.

“We’re going to warn a million people who may have been exposed to these apps, which doesn’t necessarily mean they’ve been hacked,” David Agranovich, director of Meta’s cybersecurity team, told a news conference.

Parent company of Facebook and Instagram, Meta has mapped since the beginning of the year more than 400 “evil” applications. They are available for smartphones operated with Apple and Google’s operating services, iOS and Android respectively.

“These apps were present on the Google Play Store and Apple’s App Store, and posed as photo editing tools, games, VPN and other services,” the company specified in a statement.

Once installed on the phone, these apps would ask Facebook users for their credentials to use the features.

“They tried to encourage people’s confidential information to be given out, to allow hackers to access their accounts,” summarized Agranovich, who assessed that the developers of these applications were looking for other passwords, not just Facebook.

“The aim seemed to be relatively indiscriminate,” he points out. It was about “getting as many passwords as possible.”

The company said it shared its findings with Apple and Google.

Apple did not respond to AFP requests, as Google claimed to have removed most of the apps scored by Meta from the Play Store.

“None of the apps identified in the report are available on Google Play,” a Google spokesperson wrote to AFP.

More than 40% of the applications indicated were for photo editing. Others were simple tools, like turning your cell phone into a flashlight, for example.

Agranovich recommended that users be careful when an app asks for passwords for no valid reason or makes a “too good to be true” promise.