Google and Apple have both removed the third-party Instagram app InstaAgent from their respective app stores that was busy stealing user passwords.
InstaAgent was advertised as a way for Instagram users to track who was viewing their page, but instead pulled out the user’s Instagram passwords and usernames, which were then used to spam other accounts, according to published reports. Before it was yanked InstaAgent had been downloaded at least 500,000 times, according to Apple Insider. A firm number for Google Play downloads was not available.
While Google Play has been home to many nefarious apps, it had been a rare occurrence when one popped up in Apple’s more tightly controlled App Store. However, lately this has been changing. In September, the company had to deal with a compromise centered on XcodeGhost malware being discovered in hundreds of iOS apps and earlier this month several thousand apps may have contained backdoored versions of an ad library, which could have allowed for surveillance without users’ knowledge.