Instagram credentials Stealer: Disguised as Mod App

McAfee Mobile Research describes an Android credential-stealing malware that masquerades as the Instander Instagram mod to trick users into entering credentials, then exfiltrates those credentials by abusing Firebase's createUserWithEmailAndPassword API (combining user input with a static domain and password) and sending data in Protobuf format to www.googleapis.com; the report includes behavioral analysis, network observations, and an SHA256 sample identified as Android/InstaStealer.