Whether it has reached you as “My First Video,” “My Video,” or “Private Video,” all these refer to a malicious Facebook scam
Previous week HackRead informed users around the world about the ‘Account Violation’ Policy phishing scam that was circulating on Facebook, which compelled users to send in details of their login credentials to the attackers. Now another scam is targeting users on the social media dropping malware on their PCs.
In this new campaign, scammers have embedded malicious links in Facebook posts and these are then posted on your timeline or sent to you via private message section on the social network. The titles (“My First Video,” “My Video,” or “Private Video,”) are of those videos that are part of the posts. The post tags different people from the contact list of a victim and then tricks them into clicking on the links. This means the malware has been hidden in these videos.
Not only the malware posts on your profile but it also tags your friends without your knowledge or permission
But, what happens when you click on the malicious link? Well, you are instantly prompted that you need to download a plugin to play the video. If you install this plugin then be prepared for being bombarded with fake video posts on your Facebook. Needless to say that all or majority of your friends on Facebook will also be tagged as these fake, malicious videos and thus, the malware will keep on spreading.
However, don’t assume that the malware will only post videos on your Facebook page because it is capable of performing several other functions as well including adding more friends to your Facebook profile page, creating fake pages on Facebook on your behalf, sharing/creating or editing and even hiding posts and unfollowing users. According to IT security firm ESET, these other functions are not yet active but very soon these might be.
A user who had her profile affected by the latest scam
Currently, this malware targeted only Chrome users, however, as per the analysis of ESET, it cannot be guaranteed that it may affect other browsers in the near future. ESET has also identified that this threat has managed to affect users all over the world and has been detected around 100,000 times in the previous week.
EST’s malware analyst Lukas Stefanko stated in the official blog post of the security service that:
“At this very moment, the malicious campaign is spreading spam messages and infecting Facebook accounts with a very high rate of success. However, it has the potential to become more dangerous in the future, spreading other, more powerful malware with new capabilities”.
More details and how the malware actually starts spreading is available on ESET’s official blog post.
