Schoolyard Bully Trojan Apps Stole Facebook Credentials from Over 300,000 Android Users

More than 300,000 users across 71 countries have been victimized
by a new Android threat campaign called the Schoolyard
Bully Trojan.

Mainly designed to steal Facebook credentials, the malware is
camouflaged as legitimate education-themed applications to lure
unsuspecting users into downloading them.

The apps, which were available for download from the official
Google Play Store, have now been taken down. That said, they still
continue to be available on third-party app stores.

“This trojan uses JavaScript injection to steal the Facebook
credentials,” Zimperium researchers Nipun Gupta and Aazim Bill SE
Yaswant said in a report^[1]
shared with The Hacker News.

It achieves this by launching Facebook’s login page in a
WebView, which also embeds within it malicious JavasCript code to
exfiltrate the user’s phone number, email address, and password to
a configured command-and-control (C2) server.

The Schoolyard Bully Trojan further makes use of native
libraries such as “libabc.so” so as to avoid detection by antivirus
solutions.

While the malware singles out Vietnamese language applications,
it has also been discovered in several other apps available in over
70 countries, underscoring the scale of the attacks.

The findings come more than a year after Zimperium unearthed
similar activity aimed at compromising Facebook accounts through
rogue Android apps as part of a campaign codenamed FlyTrap^[2].

“Attackers can cause a lot of havoc by stealing Facebook
passwords,” Richard Melick, director of mobile threat intelligence
at Zimperium, said. “If they can impersonate someone from their
legitimate Facebook account, it becomes extremely easy to phish
friends and other contacts into sending money or sensitive
information.”

“It’s also very concerning how many people reuse the same
passwords. If an attacker steals someone’s Facebook password,
there’s a high probability that same email and password will work
with banking or financial apps, corporate accounts and so much
more.”