A recent incident at Meta’s Facebook left users worried as the social media giant announced earlier this week that over a million users may have had their credentials compromised. The reason behind the security lapse – malicious apps that trick users into giving the app their login credentials under false guises. A report by Bloomberg suggests that a number of malicious apps that were available on the Play Store and App Store were disguised as photo editors, mobile games and health trackers, among others. This makes it hard for most people to identify what could potentially be problematic apps since such apps are built around offering a false use-case. Malicious apps will offer to provide extra bonus features by getting users to log in with their Facebook account (or another social media account). This seemingly harmless act tricks users into opening in-app windows where they will sign in with their usernames and passwords. Similar to how keyloggers work, once a user enters their credentials, the malicious apps may keep a record of the same and send it to remote attackers when the phone is next connected to mobile data or Wi-Fi. Facebook has said that not all the roughly 1 million devices may have had their credentials compromised, but the company plans to share tips with potential victims on how they can avoid being “re-compromised” by learning to spot potentially malicious apps.