Security experts from Kaspersky monitored a phishing campaign launched to spread a Facebook malware that infected more than 10,000 users in just two days
Security experts from Kaspersky monitored a phishing campaign that hit Israeli media beginning June 26th.
Thousands of Facebook users reported that they had been infected by a malware spread through the Facebook platform after they received a message from a friend claiming they had mentioned them in a comment.
“On the morning of 26th June, news of a phishing campaign hit the Israeli media. Thousands of Facebook users complained that they had been infected by a virus through their accounts after they received a message from a Facebook friend claiming they had mentioned them in a comment,” reported Kaspersky. “The Kaspersky Security Network (KSN) recorded almost ten thousand infection attempts around the globe in the space of just 48 hours.”
Researchers that investigated the issue confirmed the attack and discovered that numerous infections were observed in Brazil, Poland, Peru, Colombia, Mexico, Ecuador, Greece, Portugal, Tunisia, Venezuela and Germany.
The Facebook malware was reportedly spread in a two-stage attack:
In the first stage when the victim clicked on “mention,” a malicious file seized control of their browsers, terminating their legitimate browser session and replacing it with a malicious one that included a tab to the legitimate Facebook login page. The fake login page was used to steal login credentials of the victims. When the victims logged in, their session was hijacked in the background, and a new file was downloaded. This represented the second stage of the attack.
In the second stage of the attack, a script embedded in the file downloaded in the first stage is executed. The script allows the attackers to take over the victim’s account script, includes a privacy-settings changer, account-data extractor and other utilities that could be used for further malicious activities, like spamming and generating fraudulent “likes” and “shares.”
After logging in, victims can see that the attack is launched against the user’s entire Facebook list. All the victims’ friends receive a notification by the victim about a new URL. Upon clicking on this URL, the user’s friends will also be infected by the Facebook malware, and the attack chain loops again.
The Facebook malware mainly targeted users with Windows-based machines, but those using Windows OS phones could have been at risk as well. Android and iOS users were not impacted since the Facebook malware doesn’t use libraries compatible with these mobile OSs.
Kaspersky suggests the following actions to check if the Facebook malware compromised your account:
- Open your Chrome browser.
- Look for the extension named thnudoaitawxjvuGB.
- For a more thorough check, click Start > Run > copy the following command:%AppData%Mozila if the folder and files such as “autoit.exe” and “ekl.au3” are in it, the computer is infected.
(Security Affairs – Facebook malware, phishing)
Share On
