Android Trojan Goes After Facebook Accounts
A new Android Trojan has hijacked more than 10,000 Facebook accounts by stealing session cookies, according to researchers at Zimperium. The malware uses social engineering to trick users into installing malicious apps from the Google Play Store and third-party app stores.
“The threat actors made use of several themes that users would find appealing such as free Netflix coupon codes, Google AdWords coupon codes, and voting for the best football (soccer) team or player,” Zimperium says. “Initially available in Google Play and third-party stores, the application tricked users into downloading and trusting the application with high-quality designs and social engineering.”
After the app is installed, the user is asked to log into their Facebook account. Notably, this attack uses Facebook’s legitimate single-sign-on portal rather than a credential phishing page.
“Contrary to popular belief that a phishing page is always at the forefront for compromising or hijacking an account, there are ways to hijack sessions even by logging into the original and legit domain,” the researchers explain. “This Trojan exploits one such technique known as JavaScript injection. Using this technique, the application opens the legit URL inside a WebView configured with the ability to inject JavaScript code and extracts all the necessary information such as cookies, user account details, location, and IP address by injecting malicious JS code.”
Zimperium also discovered that the attackers had left their command-and-control server exposed to the public internet, so anyone could access the stolen information and use it in further social engineering attacks.
“Malicious threat actors are leveraging common user misconceptions that logging into the right domain is always secure irrespective of the application used to log in,” the researchers write. “The targeted domains are popular social media platforms and this campaign has been exceptionally effective in harvesting social media session data of users from 144 countries. These accounts can be used as a botnet for different purposes: from boosting the popularity of pages/sites/products to spreading misinformation or political propaganda.”
New-school security awareness training can enable your employees to follow security best practices.
Zimperium has the full story.
Don’t get hacked by social media phishing attacks!
Many of your users are active on Facebook, LinkedIn, and Twitter. Cybercriminals use these platforms to scrape profile information of your users and organization to create targeted spear phishing campaigns in an attempt to hijack accounts, damage your organization’s reputation, or gain access to your network.
KnowBe4’s Social Media Phishing Test is a complimentary IT security tool that helps you identify which users in your organization are vulnerable to these types of phishing attacks that could put your users and organization at risk.
Here’s how the Social Media Phishing Test works:
- Immediately start your test with your choice of three social media phishing templates
- Choose the corresponding landing page your users see after they click
- Show users which red flags they missed or send them to a fake login page
- Get a PDF emailed to you in 24 hours with your percentage of clicks and data entered
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/social-media-phishing-test-partner?partnerid=001a000001lWEoJAAW