Protect your account from mobile apps designed to steal your information

Facebook.com on mobile browsers is in the process of being updated. See more

Third-party app stores may offer mobile apps that appear legitimate but are actually maliciously designed to steal your login information. These account compromise mobile apps might be phishing for your Facebook or Instagram login credentials, or your login credentials for another app. By knowing what to look for when downloading a new mobile app, you can better identify these malicious apps and keep your accounts secure.

We’re always looking to detect and take action against these third-party malicious apps. If we believe you may have logged into Facebook using one of these mobile apps, we may send an alert to warn you so you can take steps to protect your account. If you think you’ve been impacted by malware, we encourage you to use the Security Checkup Tool to help secure your account.

You can use Security Checkup to review and add more security to your account.

To start Security Checkup:

Log into your Facebook account on a computer

Go to www.facebook.com/help/securitycheckup

Click Start security checkup .

What to do if you receive a message from Facebook that your account might be compromised

If we believe you've logged into Facebook from a malicious app, we may send you a warning message to help you secure your account. While there is a chance that this is a false alarm, we want to alert you so that you can take precautionary steps to protect your account. Because these apps are typically downloaded from the internet, off of our platforms, we may not always catch every single instance. If you believe you’ve downloaded a malicious app and have logged in with your Facebook credentials, we recommend that you delete the app from your device immediately and follow the following instructions to secure your account:

Reset your password. Never reuse your password across multiple websites.

Enable two-factor authentication , to add an extra security layer to your account.

Turn on log-in alerts so you’ll be notified if someone is trying to access your account. Be sure to review your previous sessions to make sure you recognize which devices have access to your account.

Visit the Security Checkup Tool to help secure your account.

Account compromise mobile apps and how to identify them

Visit Newsroom to get the full story on Account Compromise Mobile Apps and learn how to protect yourself from them.

Account compromise mobile apps

Apps that steal online credentials use a malicious software known as malware. Account compromise mobile apps are malware disguised as apps with fun or useful functions — like cartoon image editors or music players — and published on mobile app stores. If you install a malware app, it may ask you to “Login With Facebook” before you are able to use its promised features. If you input your login information, this malicious app would now have it as well. If your login information is stolen, attackers could potentially gain full access to your account and do things like message your friends or access private information.

The Meta security team often sees these malicious apps disguised as:

Photo editors, including those that claim to allow you to “turn yourself into a cartoon”.

VPNs claiming to boost browsing speed or grant access to blocked content or websites.

Phone utilities such as flashlight apps that claim to brighten your phone’s flashlight.

Mobile games falsely promising high-quality 3D graphics.

Health and lifestyle apps such as horoscopes and fitness trackers.

Business or ad management apps claiming to provide hidden or unauthorized features not found in official apps by tech platforms.

Remember that legitimate apps may ask you to sign in with Facebook, and logging into these authorized apps is safe and secure. There are also many legitimate apps that offer the features listed above. Malware authors know how popular these types of apps are and use these themes to trick users and steal their accounts and information.

Identify account compromise mobile apps

Malware apps often have signs that differentiate them from legitimate apps. Here are a few things to consider before logging into a mobile app with your Facebook account:

The app requires social media credentials: Is the app unusable if you don’t provide your Facebook information? For example, be suspicious of a photo-editing app that needs your Facebook login and password before allowing you to use it.

The app’s reputation: Is the app reputable? Look at its download count, ratings and reviews, including negative ones.

Promised features: Does the app provide the functionality it says it will, either before or after logging in?

Here are a few examples of malware apps we found that provide no functionality until you log in with your social media account.

Was this helpful?

Protect your personal and business account from malicious software designed to steal your login information

Keeping Your Account Secure

Keeping Your Information Safe

Keep your Facebook account secure

What is data scraping and what can I do to protect my information on Facebook?

Facebook

Unsupported Browser

Protect your account from mobile apps designed to steal your information

Account compromise mobile apps and how to identify them

Account compromise mobile apps and how to identify them

Related Articles