Facebook security: Meta says 1 million accounts may have been exposed to over 400 malware apps

Meta recently released findings of a security threat report that found more than 400 Android and iOS apps infected with malware that can steal users' Facebook login credentials. The social media giant said it has started notifying users who may have been exposed to these apps and provided some tips on how to secure their accounts.

Security researchers of Facebook's parent company reportedly identified hundreds of malicious apps on Play Store and App Store this year alone. Meta's findings were reported to Google and Apple before the social media giant published its report, adding that the apps in question have since been removed from the digital stores.

Meta, however, confirmed to the Washington Post that the malicious apps may have compromised up to one million Facebook accounts before they were taken down. Google confirmed to the publication that the malicious apps had been removed, while Apple did not comment on the report. "We are also alerting people who may have unknowingly self-compromised their accounts by downloading these apps and sharing their credentials, and are helping them to secure their accounts," Meta said in a blog post.

The Facebook parent company said the malicious apps were commonly disguised as photo editors, mobile games, VPN providers, and business apps. The blog post did not specify any app, but it provided some descriptions of how the malware-infected apps were marketed. In one example, Meta said a malicious photo editor app promised users it could help them "turn yourself into a cartoon." The research also found malicious ad management apps that claimed to provide users access to "hidden or unauthorized features" not available on official versions of the apps.

While the apps involved in the research have been removed from the App Store and Play Store, Meta still advises users to watch out for "telltale signs" of malware apps. "Be suspicious of a photo-editing app that needs your Facebook login and password before allowing you to use it," Meta said. Users are also advised to look at an app's ratings, download count, and reviews. But the company noted that creators of malware apps often mask negative feedback by publishing fake reviews.

Facebook users who believe they have downloaded and linked their accounts to malicious apps are advised to reset their login credentials and use strong passwords. Meta also recommends users enable two-factor authentication and turn on log-in alerts to receive immediate notifications when someone else tries to access their accounts.

Photo by Souvik Banerjee (@rswebsols) from Unsplash