{"id":154766,"date":"2022-06-10T10:13:41","date_gmt":"2022-06-10T17:13:41","guid":{"rendered":"https:\/\/www.mcafee.com\/blogs\/?p=154766"},"modified":"2023-07-12T10:01:01","modified_gmt":"2023-07-12T17:01:01","slug":"instagram-credentials-stealer-disguised-as-mod-app","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/instagram-credentials-stealer-disguised-as-mod-app\/","title":{"rendered":"Instagram credentials Stealer: Disguised as Mod App"},"content":{"rendered":"<p><span data-contrast=\"none\">Authored by Dexter Shin<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">McAfee\u2019s Mobile Research Team introduced a new Android malware targeting Instagram users who want to increase their followers or likes in the last post. As we researched more about this threat, we found another malware type that uses different technical methods to steal user\u2019s credentials. The target is users who are not satisfied with the default functions provided by Instagram. Various Instagram modification application already exists for those users on the Internet. The new malware we found pretends to be a popular mod app and steals Instagram credentials.<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<h2><b><span data-contrast=\"auto\">Behavior analysis<\/span><\/b><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"auto\">Instander is one of the famous Instagram modification applications available for Android devices to help Instagram users access extra helpful features. The mod app supports uploading high-quality images and downloading posted photos and videos.<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">The initial screens of this malware and Instander are similar, as shown below.<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-154781 size-full\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/insta-1.png\" alt=\"\" width=\"362\" height=\"746\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/insta-1.png 362w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/insta-1-146x300.png 146w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/insta-1-63x129.png 63w\" sizes=\"auto, (max-width: 362px) 100vw, 362px\" \/><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-154767 size-full\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/insata-2.png\" alt=\"\" width=\"362\" height=\"761\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/insata-2.png 362w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/insata-2-143x300.png 143w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/insata-2-61x129.png 61w\" sizes=\"auto, (max-width: 362px) 100vw, 362px\" \/><\/p>\n<p><b><span data-contrast=\"auto\">Figure <\/span><\/b><b><span data-contrast=\"auto\">1<\/span><\/b><b><span data-contrast=\"auto\">. Instander legitimate app(Left) and Mmalware(Right)<\/span><\/b><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Next, this malware requests an account (username or email) and password. Finally, this malware displays an error message regardless of whether the login information is correct.<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-154809 size-full\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/insta-1.1.png\" alt=\"\" width=\"362\" height=\"761\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/insta-1.1.png 362w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/insta-1.1-143x300.png 143w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/insta-1.1-61x129.png 61w\" sizes=\"auto, (max-width: 362px) 100vw, 362px\" \/><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-154795 size-full\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/insata-2.2.png\" alt=\"\" width=\"362\" height=\"761\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/insata-2.2.png 362w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/insata-2.2-143x300.png 143w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/insata-2.2-61x129.png 61w\" sizes=\"auto, (max-width: 362px) 100vw, 362px\" \/><\/p>\n<p><b><span data-contrast=\"auto\">Figure <\/span><\/b><b><span data-contrast=\"auto\">2<\/span><\/b><b><span data-contrast=\"auto\">. Malware requests account and password<\/span><\/b><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">The malware steals the user\u2019s username and password in a very unique way. The main trick is to use the Firebase API. First, the user input value is combined with l@gmail.com. This value and static password(=kamalw20051) are then sent via the Firebase API, createUserWithEmailAndPassword. And next, the password process is the same. After receiving the user&#8217;s account and password input, this malware will request it twice.<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<figure id=\"attachment_154823\" aria-describedby=\"caption-attachment-154823\" style=\"width: 907px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-154823\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/comde.png\" alt=\"Figure 3. Main method to use Firebase API\" width=\"907\" height=\"162\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/comde.png 907w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/comde-300x54.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/comde-768x137.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/comde-205x37.png 205w\" sizes=\"auto, (max-width: 907px) 100vw, 907px\" \/><figcaption id=\"caption-attachment-154823\" class=\"wp-caption-text\">Figure 3. Main method to use Firebase API<\/figcaption><\/figure>\n<p><span class=\"TextRun SCXW236871260 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW236871260 BCX0\">Since we cannot see the dashboard of the malware author, we tested it using the same API. As a result, we checked the user input value in plain text on the dashboard.<\/span><\/span><span class=\"EOP SCXW236871260 BCX0\" data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<figure id=\"attachment_154837\" aria-describedby=\"caption-attachment-154837\" style=\"width: 905px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-154837\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/auth.png\" alt=\"Figure 4. Firebase dashboard built for testing \" width=\"905\" height=\"491\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/auth.png 905w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/auth-300x163.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/auth-768x417.png 768w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/auth-205x111.png 205w\" sizes=\"auto, (max-width: 905px) 100vw, 905px\" \/><figcaption id=\"caption-attachment-154837\" class=\"wp-caption-text\">Figure 4. Firebase dashboard built for testing<\/figcaption><\/figure>\n<p><span data-contrast=\"auto\">According to the Firebase document, createUserWithEmailAndPassword API is to create a new user account associated with the specified email address and password. Because the first parameter is defined as email patterns, the malware author uses the above code to create email patterns regardless of user input values.<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">It is an API for creating accounts in the Firebase so that the administrator can check the account name in the Firebase dashboard. The victim&#8217;s account and password have been requested as Firebase account name, so it should be seen as plain text without hashing or masking.<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<h2><b><span data-contrast=\"auto\">Network traffic<\/span><\/b><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"auto\">As an interesting point on the network traffic of the malware, this malware communicates with the Firebase server in Protobuf format in the network. The initial configuration of this Firebase API uses the JSON format. Although the Protobuf format is readable enough, it can be assumed that this malware author intentionally attempts to obfuscate the network traffic through the additional settings. Also, the domain used for data transfer(=www.googleapis.com) is managed by Google. Because it is a domain that is too common and not dangerous, many network filtering and firewall solutions do not detect it.<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<h2><b><span data-contrast=\"auto\">Conclusion<\/span><\/b><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"auto\">As mentioned, users should always be careful about installing 3rd party apps. Aside from the types of malware we&#8217;ve introduced so far, attackers are trying to steal users&#8217; credentials in a variety of ways. Therefore, you should employ security software on your mobile devices and always keep up to date.<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Fortunately, McAfee Mobile Security is able to detect this as Android\/InstaStealer and protect you from similar threats. For more information visit\u00a0 <\/span><a href=\"https:\/\/www.mcafeemobilesecurity.com\/\" target=\"_blank\" rel=\"noopener\"><span data-contrast=\"none\">McAfee Mobile Security<\/span><\/a><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<h2><b><span data-contrast=\"auto\">Indicators of Compromise<\/span><\/b><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/h2>\n<p><span data-contrast=\"auto\">SHA256:<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6}\">\u00a0<\/span><\/p>\n<ul>\n<li data-leveltext=\"\uf06c\" data-font=\"Wingdings\" data-listid=\"1\" data-list-defn-props=\"{&quot;335551671&quot;:0,&quot;335552541&quot;:1,&quot;335559684&quot;:-2,&quot;335559685&quot;:760,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Wingdings&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf06c&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" aria-setsize=\"-1\" data-aria-posinset=\"0\" data-aria-level=\"1\"><span data-contrast=\"auto\">238a040fc53ba1f27c77943be88167d23ed502495fd83f501004356efdc22a39<\/span><span data-ccp-props=\"{&quot;335551550&quot;:6,&quot;335551620&quot;:6,&quot;335559795&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Authored by Dexter Shin\u00a0 McAfee\u2019s Mobile Research Team introduced a new Android malware targeting Instagram users who want to increase&#8230;<\/p>\n","protected":false},"author":695,"featured_media":154865,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[1814,76,4452,180,214,4222,321],"coauthors":[4136],"class_list":["post-154766","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-mcafee-labs","tag-computer-security","tag-cybercrime","tag-cybersecurity","tag-malware","tag-mobile-security1","tag-social-media","tag-social-networking"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Instagram credentials Stealer: Disguised as Mod App | McAfee Blog<\/title>\n<meta name=\"description\" content=\"Authored by Dexter Shin\u00a0 McAfee\u2019s Mobile Research Team introduced a new Android malware targeting Instagram users who want to increase their followers or\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Instagram credentials Stealer: Disguised as Mod App | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"Authored by Dexter Shin\u00a0 McAfee\u2019s Mobile Research Team introduced a new Android malware targeting Instagram users who want to increase their followers or\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/instagram-credentials-stealer-disguised-as-mod-app\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2022-06-10T17:13:41+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-07-12T17:01:01+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/300x200_Blog_childphones-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"300\" \/>\n\t<meta property=\"og:image:height\" content=\"200\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"McAfee Labs\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee_Labs\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee Labs\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/instagram-credentials-stealer-disguised-as-mod-app\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/instagram-credentials-stealer-disguised-as-mod-app\/\"},\"author\":{\"name\":\"McAfee Labs\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\"},\"headline\":\"Instagram credentials Stealer: Disguised as Mod App\",\"datePublished\":\"2022-06-10T17:13:41+00:00\",\"dateModified\":\"2023-07-12T17:01:01+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/instagram-credentials-stealer-disguised-as-mod-app\/\"},\"wordCount\":607,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/instagram-credentials-stealer-disguised-as-mod-app\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/300x200_Blog_childphones-1.jpg\",\"keywords\":[\"computer security\",\"cybercrime\",\"cybersecurity\",\"malware\",\"mobile security\",\"social media\",\"social networking\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/instagram-credentials-stealer-disguised-as-mod-app\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/instagram-credentials-stealer-disguised-as-mod-app\/\",\"name\":\"Instagram credentials Stealer: Disguised as Mod App | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/instagram-credentials-stealer-disguised-as-mod-app\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/instagram-credentials-stealer-disguised-as-mod-app\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/300x200_Blog_childphones-1.jpg\",\"datePublished\":\"2022-06-10T17:13:41+00:00\",\"dateModified\":\"2023-07-12T17:01:01+00:00\",\"description\":\"Authored by Dexter Shin\u00a0 McAfee\u2019s Mobile Research Team introduced a new Android malware targeting Instagram users who want to increase their followers or\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/instagram-credentials-stealer-disguised-as-mod-app\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/instagram-credentials-stealer-disguised-as-mod-app\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/instagram-credentials-stealer-disguised-as-mod-app\/#primaryimage\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/300x200_Blog_childphones-1.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/300x200_Blog_childphones-1.jpg\",\"width\":300,\"height\":200},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/instagram-credentials-stealer-disguised-as-mod-app\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Instagram credentials Stealer: Disguised as Mod App\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\",\"name\":\"McAfee Labs\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"caption\":\"McAfee Labs\"},\"description\":\"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee_Labs\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Instagram credentials Stealer: Disguised as Mod App | McAfee Blog","description":"Authored by Dexter Shin\u00a0 McAfee\u2019s Mobile Research Team introduced a new Android malware targeting Instagram users who want to increase their followers or","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Instagram credentials Stealer: Disguised as Mod App | McAfee Blog","og_description":"Authored by Dexter Shin\u00a0 McAfee\u2019s Mobile Research Team introduced a new Android malware targeting Instagram users who want to increase their followers or","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/instagram-credentials-stealer-disguised-as-mod-app\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2022-06-10T17:13:41+00:00","article_modified_time":"2023-07-12T17:01:01+00:00","og_image":[{"width":300,"height":200,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/300x200_Blog_childphones-1.jpg","type":"image\/jpeg"}],"author":"McAfee Labs","twitter_card":"summary_large_image","twitter_creator":"@McAfee_Labs","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee Labs","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/instagram-credentials-stealer-disguised-as-mod-app\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/instagram-credentials-stealer-disguised-as-mod-app\/"},"author":{"name":"McAfee Labs","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad"},"headline":"Instagram credentials Stealer: Disguised as Mod App","datePublished":"2022-06-10T17:13:41+00:00","dateModified":"2023-07-12T17:01:01+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/instagram-credentials-stealer-disguised-as-mod-app\/"},"wordCount":607,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/instagram-credentials-stealer-disguised-as-mod-app\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/300x200_Blog_childphones-1.jpg","keywords":["computer security","cybercrime","cybersecurity","malware","mobile security","social media","social networking"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/instagram-credentials-stealer-disguised-as-mod-app\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/instagram-credentials-stealer-disguised-as-mod-app\/","name":"Instagram credentials Stealer: Disguised as Mod App | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/instagram-credentials-stealer-disguised-as-mod-app\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/instagram-credentials-stealer-disguised-as-mod-app\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/300x200_Blog_childphones-1.jpg","datePublished":"2022-06-10T17:13:41+00:00","dateModified":"2023-07-12T17:01:01+00:00","description":"Authored by Dexter Shin\u00a0 McAfee\u2019s Mobile Research Team introduced a new Android malware targeting Instagram users who want to increase their followers or","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/instagram-credentials-stealer-disguised-as-mod-app\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/instagram-credentials-stealer-disguised-as-mod-app\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/instagram-credentials-stealer-disguised-as-mod-app\/#primaryimage","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/300x200_Blog_childphones-1.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2022\/06\/300x200_Blog_childphones-1.jpg","width":300,"height":200},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/instagram-credentials-stealer-disguised-as-mod-app\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Instagram credentials Stealer: Disguised as Mod App"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad","name":"McAfee Labs","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","caption":"McAfee Labs"},"description":"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.","sameAs":["https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee_Labs"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/154766","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/695"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=154766"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/154766\/revisions"}],"predecessor-version":[{"id":171508,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/154766\/revisions\/171508"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media\/154865"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=154766"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=154766"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=154766"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=154766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}