Malicious actors have created an Android app which carried with it a password stealer, and possibly – an identity and biometrics stealer, as “added value”.
Discovered by researchers at security firm Praedo, the “Craftsart Cartoon Photo Tools” promised to “cartoonify” a photo, but inorder to do so, users needed to log into their Facebook account.
However whatever details users provided to the app, (which ironically did appear to sometimes do exactly what it promsied concerning catoonifying images) did not log them into Facebook, but was instead sent to the app devs’ own command and control (C2) server.
