Home > News

Android Malware Can Steal Your Login Data by Imitating Uber App

By Laura Tucker
Android Malware Can Steal Your Login Data by Imitating Uber App Featured Image

There’s no arguing that one of the greatest ideas for an app/service is Uber. It provides immeasurable help, starting off by offering you ride-sharing to the destination of your choice and now adding on food delivery.

But while it’s still a great service, the latest Android.Fakeapp malware variant steals important factors of Uber to make you think you’re using the Uber app when you’re really using the malware which is stealing your data.

The Steal

Everyone who has used the Uber app is familiar with how it works and the windows it uses, such as the login screen and the user location screen. And that’s how the malware tricks you into thinking that it’s real.

The malware pops up on an Android user’s screen intermittently with what appears to be an Uber login screen. It keeps showing up until the user is eventually tricked into believing that it’s really Uber looking for login details, which typically include the user’s phone number along with their password.

Once the user inputs their login details and clicks Next, they’ve just given their login details to the malware’s remote server.

It needs to be remembered what they’ve just given the malware along with their login details. This means the malware now has access to everything stored on Uber. Not only do they have your home address, they now have access to your credit card.

news-android-malware-uber-android

The Cover Up

But the malware isn’t content with just this. They want to make sure that you don’t suspect anything. After scamming your login details, it pops up another screen so that it doesn’t alarm you.

Cleverly, the malware pops up a screen that imitates the real Uber app. It shows you your current location, as this is what Uber would do, assuming you want a ride from your current location to another location.

In order to show this screen the malware uses the deep link URL of the real Uber app.

Deep links are used by apps to take you to specific content inside an app. It works similarly to a web URL, but instead of an exact website location, it’s an exact app location.

The user is completely fooled by this point and doesn’t suspect anything so that the malware can get away with stealing the information, leaving the user completely unaware.

news-android-malware-uber-security

Keeping Your Android Safe

This malware threat was reported by Symantec, a known software company that provides security. They, of course, suggest you use their software to keep yourself protected from this Android.Fakeapp malware variant and others.

But there are certainly other steps you can take as well. You should always keep your Android and software up to date. Additionally, you should only download apps from trusted sources and never from unfamiliar sites.

Also, be aware of the permissions that are requested by apps. Instead of just supplying the permissions automatically, be sure of who and what you’re giving these permissions to.

And, as always, be sure to keep all your information backed up. That’s always a good practice, not just in this case.

The Irony of Safety

Ironically, Uber offers its ride-sharing service to help you and in many ways keeps you safe, giving you safe transportation when you need it.

But this malware threat takes that safety and more away from you. But as long as you take the proper precautions, you can stay safe and keep all your data safe as well.

Have you come across this malware or a similar one that has tried to steal all your data? Let us know in the comments if this has ever happened to you.

Subscribe to our newsletter!

Our latest tutorials delivered straight to your inbox

Laura Tucker Avatar
Laura Tucker
Laura has spent more than 20 years writing news, reviews, and op-eds, with the majority of those years as an editor as well. She has exclusively used Apple products for the past 35 years. In addition to writing and editing at MTE, she also runs the site’s sponsored review program.

Read next

From below of blue starry sky over radio telescope and trees with leaves
The Big Ear telescope was scanning at 1420.4056 megahertz on the night of 15 August 1977, the exact frequency at which hydrogen atoms vibrate across the universe, because Giuseppe Cocconi and Philip Morrison had argued years earlier that any species trying to be found would broadcast on that channel — and then, for 72 seconds, something did.
In 2016, archaeologists dated two rings of snapped stalagmites in France’s Bruniquel Cave to 176,500 years ago, evidence that Neanderthals had walked 336 metres into darkness with fire and built architecture deep underground long before modern humans reached Europe
Otto von Bismarck was 74 when Germany adopted the world’s first national old-age social insurance program in 1889, setting the pension age at 70 after years of fighting socialists with bans, laws, and a promise few workers would live long enough to use
When cosmonaut Valeri Polyakov stepped out of his Soyuz capsule in March 1995 after 437 consecutive days aboard Mir, doctors recorded him at several centimetres above his pre-flight height, and his spine had become so unaccustomed to gravity that the recovery team carried him to a chair rather than risk the compression of letting him walk.
When Bell Labs engineer Karl Jansky pointed a rotating antenna at the sky in 1932 looking for sources of transatlantic radio static, he kept picking up a faint hiss that peaked every 23 hours and 56 minutes, and he eventually realized he had become the first human to hear the center of the Milky Way.
A contemplative scene with two scientists in a vintage laboratory setting.
When Harvard astronomer Cecilia Payne submitted her 1925 doctoral thesis arguing that the Sun was made almost entirely of hydrogen, the field’s senior figure Henry Norris Russell talked her into adding a line calling the result ‘almost certainly not real,’ and then published the same conclusion himself four years later to widespread acclaim.
When seismic waves from the Chicxulub impact reached what is now North Dakota roughly ten minutes after the asteroid struck, they appear to have triggered a ten-metre standing wave in an inland river that flung fish onto the bank and buried them under glass beads still falling from the sky.
When survivors near Lake Nyos woke on the morning of 22 August 1986, the cattle were dead in the fields, the birds had fallen out of the trees, and 1,746 of their neighbours were lying where they had stood the night before, with no fire, no flood, and no wound to explain it.