{"id":130525,"date":"2021-10-19T06:02:15","date_gmt":"2021-10-19T13:02:15","guid":{"rendered":"https:\/\/www.mcafee.com\/blogs\/?p=130525"},"modified":"2025-06-05T07:50:15","modified_gmt":"2025-06-05T14:50:15","slug":"social-networks-account-stealer-hidden-in-android-gaming-hacking-tool","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/social-networks-account-stealer-hidden-in-android-gaming-hacking-tool\/","title":{"rendered":"Social Network Account Stealers Hidden in Android Gaming Hacking Tool"},"content":{"rendered":"<p>Authored by: Wenfeng Yu<\/p>\n<p><span data-contrast=\"auto\">McAfee Mobile Research team recently discovered a new piece of malware that specifically steals Google, Facebook, Twitter, Telegram and PUBG game accounts. This malware hides in a game assistant tool called \u201cDesiEsp\u201d which is an assistant tool for PUBG game available on GitHub. Basically, cyber criminals added their own malicious code based on this DesiEsp open-source tool and published it on Telegram. PUBG game users are the main targets of this Android malware in all regions around the world but most infections are reported from the United States, India, and Saudi Arabia.<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<h2><b><span data-contrast=\"auto\">What is an ESP hack?<\/span><\/b><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/h2>\n<p><a href=\"https:\/\/combatarms.fandom.com\/wiki\/ESP_Hacks\" target=\"_blank\" rel=\"noopener\"><span data-contrast=\"none\">ESP Hacks<\/span><\/a><span data-contrast=\"auto\">, (short for Extra-Sensory Perception) are a type of hack that displays player information such as HP (Health Points), Name, Rank, Gun etc. It is like a permanent tuned-up <\/span><a href=\"https:\/\/combatarms.fandom.com\/wiki\/KDR_\/_HP_Vision\" target=\"_blank\" rel=\"noopener\"><span data-contrast=\"none\">KDR\/HP Vision<\/span><\/a><span data-contrast=\"auto\">. ESP Hacks are not a single hack, but a whole category of hacks that function similarly and are often used together to make them more effective.<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<h2><b><span data-contrast=\"auto\">How\u00a0can you be affected by this malware?<\/span><\/b><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"auto\">After investigation, it was found that this malware was\u00a0spread\u00a0in the channels related to PUBG game on the\u00a0Telegram platform. Fortunately, this malware has not been found on\u00a0Google\u00a0Play.<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<h2><b><span data-contrast=\"auto\">Main dropper behavior<\/span><\/b><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"auto\">This malware will ask the user to allow superuser permission after running:<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<p><span class=\"TextRun SCXW8999529 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW8999529 BCX0\">If the user denies superuser request<\/span><span class=\"NormalTextRun SCXW8999529 BCX0\">\u00a0the malware<\/span><span class=\"NormalTextRun SCXW8999529 BCX0\">\u00a0will s<\/span><span class=\"NormalTextRun SCXW8999529 BCX0\">ay that the application may not\u00a0<\/span><span class=\"NormalTextRun SCXW8999529 BCX0\">work<\/span><span class=\"NormalTextRun SCXW8999529 BCX0\">:<\/span><\/span><span class=\"EOP SCXW8999529 BCX0\" data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<p><span class=\"TextRun SCXW260063185 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW260063185 BCX0\">When it gains root\u00a0<\/span><span class=\"NormalTextRun SCXW260063185 BCX0\">permission,<\/span><span class=\"NormalTextRun SCXW260063185 BCX0\">\u00a0it will start two malicious actions<\/span><span class=\"NormalTextRun SCXW260063185 BCX0\">. F<\/span><span class=\"NormalTextRun SCXW260063185 BCX0\">irst,\u00a0<\/span><span class=\"NormalTextRun SCXW260063185 BCX0\">it<\/span><span class=\"NormalTextRun SCXW260063185 BCX0\">\u00a0will steal accounts by accessing the system account database and application database.\u00a0<\/span><\/span><span class=\"EOP SCXW260063185 BCX0\" data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<p><span class=\"TextRun SCXW82003022 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW82003022 BCX0\">Second, it<\/span><span class=\"NormalTextRun SCXW82003022 BCX0\">\u00a0will install a<\/span><span class=\"NormalTextRun SCXW82003022 BCX0\">n additional payload<\/span><span class=\"NormalTextRun SCXW82003022 BCX0\">\u00a0with package name<\/span><span class=\"NormalTextRun SCXW82003022 BCX0\">\u00a0<\/span><span class=\"NormalTextRun SCXW82003022 BCX0\">\u201c<\/span><span class=\"NormalTextRun SpellingErrorV2 SCXW82003022 BCX0\">com.android.google.gsf.policy_sidecar_aps<\/span><span class=\"NormalTextRun SCXW82003022 BCX0\">&#8221;\u00a0<\/span><span class=\"NormalTextRun SCXW82003022 BCX0\">using\u00a0<\/span><span class=\"NormalTextRun SCXW82003022 BCX0\">the &#8220;pm install&#8221; command.<\/span><span class=\"NormalTextRun SCXW82003022 BCX0\">\u00a0<\/span><span class=\"NormalTextRun SCXW82003022 BCX0\">The\u00a0<\/span><span class=\"NormalTextRun SCXW82003022 BCX0\">payload<\/span><span class=\"NormalTextRun SCXW82003022 BCX0\">\u00a0package will be in the assets<\/span><span class=\"NormalTextRun SCXW82003022 BCX0\">\u00a0folder<\/span><span class=\"NormalTextRun SCXW82003022 BCX0\">,<\/span><span class=\"NormalTextRun SCXW82003022 BCX0\">\u00a0and it will disguise the file name as \u201c*.<\/span><span class=\"NormalTextRun SpellingErrorV2 SCXW82003022 BCX0\">crt<\/span><span class=\"NormalTextRun SCXW82003022 BCX0\">\u201d or \u201c*.mph\u201d.<\/span><\/span><span class=\"EOP SCXW82003022 BCX0\" data-ccp-props=\"{&quot;335551550&quot;:1,&quot;335551620&quot;:1}\">\u00a0<\/span><\/p>\n<h2><b><span data-contrast=\"auto\">Stealing social and gaming accounts<\/span><\/b><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"auto\">The dropped payload will not display icons and it does not operate directly on the screen of the user&#8217;s device. In the apps list of the system settings, it usually disguises the package name as something like \u201ccom.google.android.gsf\u201d to make users think it is a system service of Google. It runs in the background in the way of Accessibility Service. Accessibility Service is an auxiliary function provided by the Android system to help people with physical disabilities use mobile apps. It will connect to other apps like a plug-in and can it access the Activity, View, and other resources of the connected app.<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">The malware will first try to get root permissions and IMEI (International Mobile Equipment Identity) code that later access the system account database. Of course, even if it does not have root access, it still has other ways to steal account information. Finally, it also will try to activate the device-admin to difficult its removal.<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<h2><b><span data-contrast=\"auto\">Methods to steal account information<\/span><\/b><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"auto\">The first method to steal account credentials that this malware uses is to monitor the login window and account input box text of the stolen app through the AccessibilityService interface to steal account information. The target apps include Facebook (com.facebook.kakana), Twitter (com.twitter.android), Google (com.google.android.gms) and PUBG MOBILE game (com.tencent.ig)<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">The second method is to steal account information (including account number, password, key, and token) by accessing the account database of the system, the user config file, and the database of the monitored app. This part of the malicious code is the same as the parent sample above:<\/span><span data-ccp-props=\"{&quot;335551550&quot;:1,&quot;335551620&quot;:1}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Finally, the malware will report the stolen account information to the hacker&#8217;s server via HTTP.\u00a0<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<h2><b><span data-contrast=\"auto\">Gaming users infected worldwide<\/span><\/b><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6,&quot;335559740&quot;:259}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"auto\">PUBG games are popular all over the world, and users who use PUBG game assistant tools exist in all regions of the world. According to McAfee telemetry data, this malware and its variants affect a wide range of countries including the United States, India, and Saudi Arabia:\u00a0<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<h2><b><span data-contrast=\"auto\">Conclusion<\/span><\/b><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6,&quot;335559740&quot;:259}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"auto\">The online game market is revitalizing as represented by e-sports. We can play games anywhere in various environments such as mobiles, tablets, and\u00a0PCs (personal computers). Some users will be looking for cheat tools and hacking techniques to play the game in a slightly advantageous way. Cheat tools are inevitably hosted on suspicious websites by their nature, and users looking for cheat tools must step into the suspicious websites. Attackers are also aware of the desires of such users\u00a0and use\u00a0these cheat tools to attack them.<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">This malware is still constantly producing variants that use several ways to counter the detection of anti-virus software including packing, code obfuscation, and strings encryption, allowing itself to infect more game users.<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">McAfee Mobile Security detects this threat as Android\/Stealer and protects you from this malware attack. Use security software on your device. Game users should think twice before downloading and installing cheat tools, especially when they request Superuser or accessibility service permissions.<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<h2><span data-contrast=\"auto\">Indicators of Compromise<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/h2>\n<h4><b><span data-contrast=\"auto\">Dropper samples<\/span><\/b><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/h4>\n<p>36d9e580c02a196e017410a6763f342eea745463cefd6f4f82317aeff2b7e1a5<\/p>\n<p>fac1048fc80e88ff576ee829c2b05ff3420d6435280e0d6839f4e957c3fa3679<\/p>\n<p>d054364014188016cf1fa8d4680f5c531e229c11acac04613769aa4384e2174b<\/p>\n<p>3378e2dbbf3346e547dce4c043ee53dc956a3c07e895452f7e757445968e12ef<\/p>\n<p>7e0ee9fdcad23051f048c0d0b57b661d58b59313f62c568aa472e70f68801417<\/p>\n<p>6b14f00f258487851580e18704b5036e9d773358e75d01932ea9f63eb3d93973<\/p>\n<p>706e57fb4b1e65beeb8d5d6fddc730e97054d74a52f70f57da36eda015dc8548<\/p>\n<p>ff186c0272202954def9989048e1956f6ade88eb76d0dc32a103f00ebfd8538e<\/p>\n<p>706e57fb4b1e65beeb8d5d6fddc730e97054d74a52f70f57da36eda015dc8548<\/p>\n<p>3726dc9b457233f195f6ec677d8bc83531e8bc4a7976c5f7bb9b2cfdf597e86c<\/p>\n<p>e815b1da7052669a7a82f50fabdeaece2b73dd7043e78d9850c0c7e95cc0013d<\/p>\n<h4><b><span data-contrast=\"auto\">Payload samples<\/span><\/b><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/h4>\n<p>8ef54eb7e1e81b7c5d1844f9e4c1ba8baf697c9f17f50bfa5bcc608382d43778<\/p>\n<p>4e08e407c69ee472e9733bf908c438dbdaebc22895b70d33d55c4062fc018e26<\/p>\n<p>6e7c48909b49c872a990b9a3a1d5235d81da7894bd21bc18caf791c3cb571b1c<\/p>\n<p>9099908a1a45640555e70d4088ea95e81d72184bdaf6508266d0a83914cc2f06<\/p>\n<p>ca29a2236370ed9979dc325ea4567a8b97b0ff98f7f56ea2e82a346182dfa3b8<\/p>\n<p>d2985d3e613984b9b1cba038c6852810524d11dddab646a52bf7a0f6444a9845<\/p>\n<p>ef69d1b0a4065a7d2cc050020b349f4ca03d3d365a47be70646fd3b6f9452bf6<\/p>\n<p>06984d4249e3e6b82bfbd7da260251d99e9b5e6d293ecdc32fe47dd1cd840654<\/p>\n<h4><b><span data-contrast=\"auto\">Domain<\/span><\/b><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"auto\">hosting-b5476[.]gq<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Authored by: Wenfeng Yu McAfee Mobile Research team recently discovered a new piece of malware that specifically steals Google, Facebook,&#8230;<\/p>\n","protected":false},"author":695,"featured_media":130549,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[],"coauthors":[4136],"class_list":["post-130525","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-mcafee-labs"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Social Network Account Stealers Hidden in Android Gaming Hacking Tool | McAfee Blog Social Network Account Stealers Hidden in Android Gaming Hacking Tool<\/title>\n<meta name=\"description\" content=\"Authored by: Wenfeng Yu McAfee Mobile Research team recently discovered a new piece of malware that specifically steals Google, Facebook, Twitter,\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Social Network Account Stealers Hidden in Android Gaming Hacking Tool | McAfee Blog Social Network Account Stealers Hidden in Android Gaming Hacking Tool\" \/>\n<meta property=\"og:description\" content=\"Authored by: Wenfeng Yu McAfee Mobile Research team recently discovered a new piece of malware that specifically steals Google, Facebook, Twitter,\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/social-networks-account-stealer-hidden-in-android-gaming-hacking-tool\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2021-10-19T13:02:15+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-05T14:50:15+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2021\/10\/300x200_AndroidGaming.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"300\" \/>\n\t<meta property=\"og:image:height\" content=\"200\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"McAfee Labs\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee_Labs\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee Labs\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/social-networks-account-stealer-hidden-in-android-gaming-hacking-tool\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/social-networks-account-stealer-hidden-in-android-gaming-hacking-tool\/\"},\"author\":{\"name\":\"McAfee Labs\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\"},\"headline\":\"Social Network Account Stealers Hidden in Android Gaming Hacking Tool\",\"datePublished\":\"2021-10-19T13:02:15+00:00\",\"dateModified\":\"2025-06-05T14:50:15+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/social-networks-account-stealer-hidden-in-android-gaming-hacking-tool\/\"},\"wordCount\":1114,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/social-networks-account-stealer-hidden-in-android-gaming-hacking-tool\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2021\/10\/300x200_AndroidGaming.jpg\",\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/social-networks-account-stealer-hidden-in-android-gaming-hacking-tool\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/social-networks-account-stealer-hidden-in-android-gaming-hacking-tool\/\",\"name\":\"Social Network Account Stealers Hidden in Android Gaming Hacking Tool | McAfee Blog Social Network Account Stealers Hidden in Android Gaming Hacking Tool\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/social-networks-account-stealer-hidden-in-android-gaming-hacking-tool\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/social-networks-account-stealer-hidden-in-android-gaming-hacking-tool\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2021\/10\/300x200_AndroidGaming.jpg\",\"datePublished\":\"2021-10-19T13:02:15+00:00\",\"dateModified\":\"2025-06-05T14:50:15+00:00\",\"description\":\"Authored by: Wenfeng Yu McAfee Mobile Research team recently discovered a new piece of malware that specifically steals Google, Facebook, Twitter,\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/social-networks-account-stealer-hidden-in-android-gaming-hacking-tool\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/social-networks-account-stealer-hidden-in-android-gaming-hacking-tool\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/social-networks-account-stealer-hidden-in-android-gaming-hacking-tool\/#primaryimage\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2021\/10\/300x200_AndroidGaming.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2021\/10\/300x200_AndroidGaming.jpg\",\"width\":300,\"height\":200},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/social-networks-account-stealer-hidden-in-android-gaming-hacking-tool\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Social Network Account Stealers Hidden in Android Gaming Hacking Tool\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\",\"name\":\"McAfee Labs\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"caption\":\"McAfee Labs\"},\"description\":\"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee_Labs\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Social Network Account Stealers Hidden in Android Gaming Hacking Tool | McAfee Blog Social Network Account Stealers Hidden in Android Gaming Hacking Tool","description":"Authored by: Wenfeng Yu McAfee Mobile Research team recently discovered a new piece of malware that specifically steals Google, Facebook, Twitter,","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Social Network Account Stealers Hidden in Android Gaming Hacking Tool | McAfee Blog Social Network Account Stealers Hidden in Android Gaming Hacking Tool","og_description":"Authored by: Wenfeng Yu McAfee Mobile Research team recently discovered a new piece of malware that specifically steals Google, Facebook, Twitter,","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/social-networks-account-stealer-hidden-in-android-gaming-hacking-tool\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2021-10-19T13:02:15+00:00","article_modified_time":"2025-06-05T14:50:15+00:00","og_image":[{"width":300,"height":200,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2021\/10\/300x200_AndroidGaming.jpg","type":"image\/jpeg"}],"author":"McAfee Labs","twitter_card":"summary_large_image","twitter_creator":"@McAfee_Labs","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee Labs","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/social-networks-account-stealer-hidden-in-android-gaming-hacking-tool\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/social-networks-account-stealer-hidden-in-android-gaming-hacking-tool\/"},"author":{"name":"McAfee Labs","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad"},"headline":"Social Network Account Stealers Hidden in Android Gaming Hacking Tool","datePublished":"2021-10-19T13:02:15+00:00","dateModified":"2025-06-05T14:50:15+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/social-networks-account-stealer-hidden-in-android-gaming-hacking-tool\/"},"wordCount":1114,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/social-networks-account-stealer-hidden-in-android-gaming-hacking-tool\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2021\/10\/300x200_AndroidGaming.jpg","articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/social-networks-account-stealer-hidden-in-android-gaming-hacking-tool\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/social-networks-account-stealer-hidden-in-android-gaming-hacking-tool\/","name":"Social Network Account Stealers Hidden in Android Gaming Hacking Tool | McAfee Blog Social Network Account Stealers Hidden in Android Gaming Hacking Tool","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/social-networks-account-stealer-hidden-in-android-gaming-hacking-tool\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/social-networks-account-stealer-hidden-in-android-gaming-hacking-tool\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2021\/10\/300x200_AndroidGaming.jpg","datePublished":"2021-10-19T13:02:15+00:00","dateModified":"2025-06-05T14:50:15+00:00","description":"Authored by: Wenfeng Yu McAfee Mobile Research team recently discovered a new piece of malware that specifically steals Google, Facebook, Twitter,","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/social-networks-account-stealer-hidden-in-android-gaming-hacking-tool\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/social-networks-account-stealer-hidden-in-android-gaming-hacking-tool\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/social-networks-account-stealer-hidden-in-android-gaming-hacking-tool\/#primaryimage","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2021\/10\/300x200_AndroidGaming.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2021\/10\/300x200_AndroidGaming.jpg","width":300,"height":200},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/social-networks-account-stealer-hidden-in-android-gaming-hacking-tool\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Social Network Account Stealers Hidden in Android Gaming Hacking Tool"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad","name":"McAfee Labs","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","caption":"McAfee Labs"},"description":"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.","sameAs":["https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee_Labs"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/130525","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/695"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=130525"}],"version-history":[{"count":3,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/130525\/revisions"}],"predecessor-version":[{"id":215145,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/130525\/revisions\/215145"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media\/130549"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=130525"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=130525"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=130525"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=130525"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}