Malicious developers have created an Android app that carries a password thief and possibly an identity and biometrics thief. Discovered by researchers at security firm Praedo, “Craftsart Cartoon Photo Tools” promised to “caricature” a photo. But to do this, users had to log into their Facebook account.
However, whatever information users provided to the app (which, ironically, sometimes fully lived up to its promise of cartooning images), did not log into Facebook and instead provided the information at the app developers’ own command and control. was sending it to the control (C2) server.
Furthermore, not all images people provide were “cartoonized” on the endpoint itself, but instead sent to a third-party server. Users have no way of knowing how long their images will stay on that server, for what purpose they are on the server, and whether the developers will sell it on the black market.
When Praedo’s analysts first discovered the app on the Google Play Store, it had been downloaded over 100,000 times and was still available for download. Now it looks like Google has removed the app as the message in the link says “Sorry, the requested URL was not found on this server”.
Limited-functionality micro-apps, which also carry malware or information thieves, are very popular with threat actors as they allow them to bypass Google’s automated security gateways. Photo editors, as well as QR code and barcode scanners, are among the types of apps that are often abused.
Although Google’s Play Store is perceived as a safe app store, security experts warn that despite the source, users should be careful when downloading apps and check app reviews.
40929
