Schoolyard Bully Android Malware Wants Your Facebook Login, Not Your Lunch Money
![schoolyard bully android malware facebook login news](https://images.hothardware.com/contentimages/newsitem/60276/content/schoolyard-bully-android-malware-facebook-login-news.jpg)
According to the researchers’ findings, this Trojan primarily targets Vietnamese users. However, the over 300,000 victims of this malware are spread across at least seventy-one countries, so this malware campaign still poses a threat to users outside of Vietnam. Zimperium researchers identified numerous apps on the Google Play Store that contained the Schoolyard Bully payload. Google has since removed these apps from the Play Store, but they are still available on third-party app stores for unsuspecting users to download.
![malicious education apps opening facebook login portal news](https://images.hothardware.com/contentimages/newsitem/60276/content/small_malicious-education-apps-opening-facebook-login-portal-news.jpg)
In a dark twist, Meta was caught earlier this year using a custom in-app browser within the Facebook, Instagram, and Messenger apps to inject what appeared to be a tracking script into webpages viewed within these apps. We wrote at the time of this discovery that it raised broader privacy and security concerns, as malicious apps could potentially use this same technique to inject code that steals login credentials. As it turns out, at least one malware campaign has been doing exactly as we speculated since 2018.
Zimperium also points out that this effort to steal Facebook login credentials may be part of a larger attempt to gain unauthorized access to victims’ bank accounts. People commonly re-use passwords across multiple accounts, as is shown by the effectiveness of credential stuffing attacks. Thus, distributing malware that subtly steals Facebook login credentials may be a more reliable method for gaining unauthorized access to users’ financial accounts than distributing banking malware, which typically requires that users grant it extensive permissions before it can be effective. When users don’t use unique passwords for each of their accounts, they shouldn’t assume that an attack on one account ends there.