#Android Malware infected 300,000 devices to steal Facebook accounts ... "The trojan steals these details by opening a legitimate Facebook login page inside the app using WebView and injecting malicious JavaScript to extract the user inputs"

https://www.bleepingcomputer.com/news/security/android-malware-infected-300-000-devices-to-steal-facebook-accounts/