Twenty-five malicious Android apps secretly created to steal Facebook account information have been removed from the Google Play Store

According to French information security firm Evina, these apps had 234 million downloads before being removed from the Play Store in early June

Evina researchers wrote in a blog post, "This malware can effectively ruin your online and offline life by taking away one of your most valuable digital real estate: your credentials"

According to angry user reviews on Google Play captured by Evina, the app also bombarded users with ads and opened new web browser tabs It is not known how many users ultimately had their Facebook credentials stolen

Twenty-five malicious apps were disguised as games, flashlights, wallpapers, image and video editing software, QR code scanners, step counters, and file managers in order to trick Android users into downloading them

While the apps performed these functions, they were also able to "check if the Facebook app was running in the foreground," according to the researchers

If so, the app would attempt to trick users into entering their Facebook credentials on a fake Facebook login page

"When the application is launched on the phone, the malware queries the application name If it is a Facebook application, the malware simultaneously launches a browser that loads Facebook

"The browser appears in the foreground, making the user think the application has been launched

By performing these actions, the user was effectively sending Facebook credentials directly to the hacker

The researchers explain: "When you enter your credentials into this browser, the malware executes JavaScript to retrieve them The malware then sends your account information to the server

Evina discovered the malicious application in May and subsequently reported it to Google After reviewing the findings, Google removed them in early June

"Downloading unknown or poorly reviewed apps from the Play Store is fraught with danger," said Jake Moore, a security specialist at ESET [These apps can damage devices or steal credentials such as passwords or one-time passwords I always recommend that users investigate apps thoroughly before even thinking about installing them [Malware can lurk in legitimate app stores, but downloads are usually small and easy to distinguish from real apps My advice is to stick to apps that have good reviews and are well-known in trusted app stores

"Additionally, to protect your social media and other accounts from hacking, turn on two-factor authentication in case your information is compromised

In addition to that, one of the best Android antivirus apps will help protect your phone from malicious apps like these, whether they come from Google Play or the "offload" app market