Malicious Android apps designed to scam can steal your Instagram passwords

Beware Instagram users as security researchers at Intel Security's mobile malware team have found several Instagram password stealers on the Google Play store. The malware distributed by these hackers mainly targeted Turkish Instagram users but their method can be replicated in future.

The threat dubbed as Android/InstaZuna has malware disguised in the form of Instagram look-alike apps that lead victims to a phishing website where users have to enter their user id and passwords. In the process the hackers can steal these account passwords using the WebView component.

As users may not be able to differentiate between legitimate and fake pages many users end up entering their details on these pages.

These credentials are then passed on to the hacker in plain text format. An unauthorised person can easily obtain the account name and password by monitoring the network connection especially if it is a free Wi-Fi network.

The situation becomes riskier if the stolen credentials of the victim are used on other websites and social network sites. The malware authors will attempt to log into other web services using the stolen accounts and passwords.

Although these dicey looking apps have now been removed by Google, similar apps may appear in future and thus Intel Security recommends that users install mobile security and password-management software and avoid downloading apps from unknown sources.