Facebook Malware Scam Takes Hold

Feb 3, 2012

Within three hours of the scam’s first appearance, more than 60,000 users had followed a link to the spoofed CNN page

A “worrying number” of Facebook users are sharing a link to a malware-laden fake CNN news page reporting the U.S. has attacked Iran and Saudi Arabia, security firm Sophos said Friday.

If users who follow the link then click to play what purports to be video coverage of the attack, they are prompted to update their Adobe Flash player with a pop-up window that looks very much like the real thing. Those who accept the prompt unwittingly install malware on their computers.

Within three hours of the scam’s first appearance, more than 60,000 users had followed a link to the spoofed CNN page, according to Sophos Senior Security Advisor Chester Wisniewski. Facebook removed that link, but others are still being shared.

“The bad guys are rotating through scam pages trying to stay ahead of Facebook,” Wisniewski said.

In a statement, Facebook said it was “in the process of cleaning up this spam now, and remediating any affected users.”

Wisniewski said there are a number of ways that status updates could appear without users’ knowledge. Their Facebook accounts could have been hacked, allowing a third party to update their status. It is also possible for scammers to exploit weaknesses in the social networking platform itself or in Web browsers to post a status update using JavaScript.

A representative status update shown in a screenshot on the Sophos blog reads, “U.S. Attacks Iran and Saudia Arabia. F**k :-( [LINK] The Begin of World War 3?”

Users who accepted the Flash player update prompt installed a fake antivirus tool on their computers. That tool would then alert them that their computer is infected with malware that can be eliminated for a fee. Such scams are one of the most lucrative, Wisniewski said, noting the irony that they net far more money than the legitimate security products Sophos and other security companies peddle.

RELATED: Protect Your Network from Facebook Malware

In addition to a healthy dose of skepticism that the U.S. would attack its ally Saudi Arabia, Facebook users can avoid the scam and others like it by updating Flash only from Adobe’s own website rather than from pop ups.

Updated 2/3/12 at 5:42 p.m. with response from Facebook

This entry was posted in News, Security, Social Media. Bookmark the permalink.

3 Responses to Facebook Malware Scam Takes Hold

  1. Betty says:

    First off it pisses me off that these harmful malware scams are being passed through a link that as an American I would most likely click on. The fear of any attacks throughout the United States is scary enough! Now lets go fake Americans out and throw some harmful crap on their computers while we are at it! ARE YOU KIDDING ME! Goes to show how very shallow people can be.
    Thanks for the information and warning! I will for sure pass this along!

    • Tony says:

      Your welcome Betty, thanks for the feeback and I couldn’t agree more…
      the reason these guys do this is because they stand to make thousands or millions of dollars and they never have to leave there desk!!!
      They don’t have to get a real job… looser’s………

  2. love your post, keep rockin dude! thumbs up!

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Powered by sweet Captcha