The Hacker News reports that threat actors have leveraged more than 200 Android apps to deploy the Facestealer spyware, which has user credential and sensitive data exfiltrating capabilities.
Numerous variants of Facestealer, which could also harvest Facebook cookies and personally identifiable information, have been developed since its discovery last July owing to the malware's frequent code changes, according to a Trend Micro report. Over 40 of the apps identified to have Facestealer were VPN services, while 20 and 13 of the applications were camera and photo editing apps, respectively. Facestealer was also discovered in more than 40 cryptomining apps.
Meanwhile, a separate study from NortonLifeLock and Boston University revealed that potentially harmful app detections totaled 8.8 million daily on more than 11.7 million Android devices from 2019 to 2020."
PHAs persist on Google Play for 77 days on average and 34 days on third-party marketplaces," said the report, which also noted the prolonged duration of PHAs when users switch devices.
Forty-five malicious NPM and PyPI packages have been deployed by threat actors to facilitate extensive data theft operations as part of a campaign that commenced on Sept. 12, according to BleepingComputer.
Sixty thousand emails from U.S. State Department accounts were noted by a staffer working for Sen. Eric Schmitt, R-Mo., to have been exfiltrated by Chinese threat actors during the widespread compromise of Microsoft email accounts that commenced in May, according to Reuters.