Facestealer spyware found in over 200 Android apps

The Hacker News reports that threat actors have leveraged more than 200 Android apps to deploy the Facestealer spyware, which has user credential and sensitive data exfiltrating capabilities. Numerous variants of Facestealer, which could also harvest Facebook cookies and personally identifiable information, have been developed since its discovery last July owing to the malware's frequent code changes, according to a Trend Micro report. Over 40 of the apps identified to have Facestealer were VPN services, while 20 and 13 of the applications were camera and photo editing apps, respectively. Facestealer was also discovered in more than 40 cryptomining apps. Meanwhile, a separate study from NortonLifeLock and Boston University revealed that potentially harmful app detections totaled 8.8 million daily on more than 11.7 million Android devices from 2019 to 2020." PHAs persist on Google Play for 77 days on average and 34 days on third-party marketplaces," said the report, which also noted the prolonged duration of PHAs when users switch devices.