Android/Trojan.Spy.FakeInsta

Short bio

Android/Trojan.Spy.FakeInsta is Malwarebytes' detection name for a Trojan targeting Iranian Instagram users.

Symptoms

After install, the app opens to a splash page, and then a page asking for Instagram credentials. When entered these credentials are then sent to the threat actors' server.

Type and source of infection

Android/Trojan.Spy.FakeInsta is an app that claims to boost your likes and increase your followers on Instagram. Android/Trojan.Spy.FakeInsta was available in the Google Play app store.

Aftermath

When your login credentials for a social media account have been stolen this can have serious consequences. It gives threat actors a base from which to gather more information.

Protection

Remediation

These apps can be uninstalled using the mobile devices uninstall functionality, but these apps can be made available under another name. That is where Malwarebytes for Android can help you, by identifying these apps and removing them.