DOZENS of Android apps have been caught nicking people's Facebook passwords without their permission, cyber security experts report.

The malicious apps were downloaded more than 2.3million times and posed as step counters, wallpaper apps, mobile games and more.

They were removed by Google from the Play Store after the search giant was alerted to the issue by researchers at French tech firm Evina.

In a report seen by ZDNet this week, Evina security gurus detailed how they routed out 25 nasty apps posing as legitimate downloads on the Play Store.

While they looked like normal apps, they were secretly stealing people's Facebook usernames and passwords.

Researchers said that once downloaded, the apps would overlay the Facebook app with a fake login page.

Users would then unwittingly plug in their username and password believing they were logging into Facebook.

However, the apps stole those credentials and then sent them to a remote server.

It's not clear what the cyber crooks planned to do with the credentials.

Usernames and passwords can easily be sold to hackers looking to break into people's other online accounts.

That's because many people use the same username and password for Facebook as they do other accounts, such as their email or Instagram.

Evina researchers said they reported the 25 malicious apps to Google at the end of May.

Google swiftly removed them from the Play Store after independently verifying the software was up to no good.

The apps posed as image editors, video editors, step counters, flashlight applications, file managers, wallpaper apps and mobile games.

How to change your Facebook password

If you believe you were affected by one of the apps, it's best you change your Facebook password right away.

1. Click the down arrow in the top-right corner of any Facebook page and select Settings.
2. Click Security and login.
3. Click Edit next to Change password.
4. Click Save Changes.

To reset your password if you're not logged in to Facebook:

1. Go to the Find your account page.
2. Type the email address, mobile phone number, full name or username associated with your account