IS specialists from Pradeo discovered a malware in the official Google Play Store stealing user passwords. The malware masquerades as the Craftsart Cartoon Photo Tools app and has been installed more than 100,000 times. The malicious app invited users to upload their photos and other images to visually stylize them to look like cartoon graphics. Craftsart Cartoon Photo Tools actually contains the FaceStealer Trojan, which displays a Facebook login screen and
requires users to log in to an account before it can begin. If the user doesn't notice the trick and actually enters their username and password, the app sends them to the attackers' control server at zutuu[.]info (VirusTotal).
Furthermore, the malware contacts a URL at www.dozenorms[.]club (VirusTotal), where it sends additional data about the system. This address has previously been used by other malicious applications containing FaceStealer.
