The Android app editor DELETED from Google Play is infected with malware

The Android app editor DELETED from Google Play is infected with malware

“Log in” with Facebook does more than just login. Like many Android apps, the “Blender Photo Editor-Easy Photo Background Editor” app comes with the sign-in with Facebook functionality. Except, it also makes use of your Facebook credentials to do some fishy stuff. Tatyana Shishkova, an Android Malware Analyst at Kaspersky, discovered the “trojan” app this week which is still available on the Google Play store, at the time of writing. malicious photo editor Android app. Photo editor Android app still sitting on the Google Play store (BleepingComputer).

The malware, according to Ingrao, “is very interested in the advertising campaigns you might have done and if you have a registered credit card.” This would allow the attacker behind these apps to create their own ad campaigns via the user’s Facebook credentials, and linked payment information. Ingrao had previously discovered similar malicious apps called “Magic Photo Lab – Photo Editor” and “Pix Photo Motion Edit 2021” with the latter scoring over 500,000 installs. Both apps have since been removed from the Google Play store. The researcher shared some insights with BleepingComputer as to how he found something wasn’t right with these apps.

Android users should be wary of such “photo editor” apps recently seen on the Google Play store. Those who have already installed any such app should uninstall the app immediately, clean up their smartphone, and reset their Facebook credentials. BleepingComputer has reported the aforementioned Blender photo editor app to Google Play prior to publishing. Update 5:05 am ET: Google Play Store has removed the Blender photo editor app following our report. An archived copy of the app page is available.

“I noticed the suspicious code first by doing a dynamic analysis,” Ingrao tells BleepingComputer in an email interview. “I noticed that the WebView was running JavaScript to retrieve the credentials. Then I downloaded the code and I recoded the function that decrypts the texts inside the code, that’s how I found the executed JavaScript and the calls to the Facebook Graph API,” continued the French security researcher. BleepingComputer also analyzed the APK for “Blender Photo Editor-Easy Photo Background Editor,” which is still live on Google Play, and can confirm seeing identical malicious code in the app. During our analysis, we attempted to roughly reconstruct the Java source code of the Android app from the compiled APK (bytecode).

Story Highlights

  • After BleepingComputer reported it to Google via the Play store, the software was quickly withdrawn. An Android software available on the Google Play market bills itself as a picture editor. However, it contains code that takes the user’s Facebook credentials in order to possibly execute ad campaigns on their behalf, complete with payment details. The app’s name is “Blender Photo Editor-Easy Photo Background Editor,” and it has been downloaded over 5,000 times. Similar malicious applications with over 500,000 installations were discovered on the Play Store last week.

  • The app contains malicious code, identical to what was found in similar “photo editor” apps last week by Maxime Ingrao, a security researcher at mobile payments cybersecurity firm Evina. These Android apps require Android users to sign in via their Facebook account to access the app, but then silently collect the credentials via encrypted JavaScript commands hidden within the app. The apps then make requests to the Facebook Graph API to peek into the user’s Facebook account and look for any ad campaigns and stored payment information.