According to Ars, Google has removed 9 apps from the Play Store after Dr. Web analysts discovered they were Trojans stealing Facebook login credentials. The malware had over 5.8 million combined downloads globally and posed as easy-to-find titles like “Horoscope Daily” and “Rubbish Cleaner.”

These apps tricked users by loading the Facebook sign-in page, only to load JavaScript from a command and control server to “hijack” login credentials and pass them along to the app and the command server. It could also steal cookies from the authorization session.

Google has told Ars that, it has banned all of the app developers responsible for this from their Play Store. However, since they can simply create new developer accounts, Google should start to screen for the malware itself to keep the attackers out.