Fake Instagram assistance apps steal Iranian users’ credentials

• These fake apps are detected by Malwarebytes as Android/Trojan.Spy.FakeInsta and are targeting Iranian users.
• The three fake Instagram assistance apps include Followkade, LikeBegir and Aseman Security.

What is the issue - Researchers from Malwarebytes Labs uncovered three Instagram assistance apps that are stealing users’ credentials. These apps are available for download in the Google Play Store.

Why it matters - These fake apps are detected by Malwarebytes as Android/Trojan.Spy.FakeInsta and are targeting Iranian users.

What are the three apps - The three fake Instagram assistance apps include Followkade, LikeBegir and Aseman Security.

The big picture

Researchers noted that these fake Instagram assistance apps claim to boost your likes, increase your followers, and protect your account from being hacked but ultimately steal your credentials.

• Upon installing the fake Instagram assistance app, the app opens a splash page.
• It then opens a login page, where it asks for users’ Instagram usernames and passwords.
• Upon entering the login credentials, the app gathers the credentials and sends to a malicious website in plain text.

Worth noting

• The ‘Followkade’ Instagram assistance app has over 50,000 installs and has a good rating of 4.0.
• The LikeBegir app claims that it will increase likes, help users buy cheap coins, and offer daily gifts.
• On the other hand, Aseman Security app claims that it will enhance security for your Instagram account and protects it from being hacked.

“I would imagine there aren’t a lot of Iranian Instagram assistance apps on Google Play, so it’s an easy target for malware authors of that region. In these cases, picking a highly-rated and installed app isn’t much help to be safe,” the researchers wrote in a blog.