Malware Spotlight: FollowKade Instagram Phisher
|by Alpha Team
On April 12 2019, Malwarebytes released a blog about a fake Instagram assistance app. The app claims to boost your likes and increase your followers if you download it. Although now removed from Google Play store, ZeroFOX has found it on multiple 3rd party Android APK websites and the app has existed for close to a year on some of these websites. The app introduces an Instagram login page in order for it to work, where the credentials are harvested and shipped into a malicious 3rd party server.
Recommendations
- Enable Mobile App rules in the ZeroFOX platform to scan for apps that may be impersonating your brand or organization
- Never use services that claim to boost your social media following, as they are against Terms of Service and almost all of them are malicious
- Enable 2-factor authentication to protect against phishing attacks
Details
The app had over 50,000 installations before being removed from the Google Play Store. The Android ecosystem has a myriad of third party app stores, so the app still exists on these markets. A recent report from Trend Micro said that mobile malware increased by 100% last year and continues to grow. ZeroFOX Alpha Team found dozens of APK sites that have cloned the Google Play store and are hosting the malware. Even freelance designer website, dribbble, has a link to the malware from what looks like a posting that the malware authors commissioned.
Tags: communications, malware, global