Beware! Craftsart Cartoon 'Cartoonifier' App Available On Google Play Store Steals Facebook Credentials

An app named Craftsart Cartoon Photo Tools is said to be stealing Facebook credentials and the app has been installed more than 100,000 times from the official Google Play Store.

Craftsart Cartoon 'Cartoonifier' App Steals Facebook Credentials/Credit: Pradeo

New Delhi: A number of third-party apps on Android that enhance images and videos are also known to house vulnerabilities and one such app named Craftsart Cartoon Photo Tools is said to be stealing Facebook credentials and the app has been installed more than 100,000 times from the official Google Play Store.

The Android malware is disguised as a "cartoonifier" app that allows users to upload an image and convert it into a cartoon rendering. The Android app essentially carries a Trojan in the form of FaceStealer and could lead to its users being scammed. As per security researchers at mobile security solutions provider Pradeo, the app pops up a Facebook login screen that requires users to log in before they can use the app.

"The application embeds an Android trojan called Facestealer that uses social engineering to steal Facebook credentials and makes connections to a Russian server. Perpetrators leveraging the spyware have full access to victims’ Facebook accounts and all data they contain, such as credit card details, conversations, searches, etc.," Roxane Suau of French mobile-security firm Pradeo, said in a statement.

"We have alerted the Google Play team of our discovery and we advise users of this app to delete it immediately."

It should be noted that Facebook credentials are used by cybercriminals to compromise accounts in multiple ways, the most common being to commit financial fraud, send phishing links as well as spread fake news. 

According to security researchers at Pradeo, the abovementioned mobile application was distributed via the Google Play Store as well as third-party application stores. To reach a large public and conceal its illegal activities, the app mimicked the behaviours of popular legitimate photo editing applications. In fact, it has been injected with a small piece of code that easily slips under the radar of store’s safeguards.