09/06/2015
Don't click on that p**n video shared by a Facebook friend: it may be malware
Security researcher claims more than 110k users of the social network were infected in two days by trojan pretending to be a Flash update
If one of your Facebook friends shares a p**nographic video clip and it appears in your news feed, think twice about clicking on it. But if you do, and it asks you to install an update for your Flash software, back away fast.
Why? It’s malware – and according to security researcher Mohammad Faghani, this pretend-p**n trojan managed to infect 110,000 Facebook users in just two days after it first appeared.
“The trojan tags the infected user’s friends in an enticing post. Upon opening the post, the user will get a preview of a p**n video which eventually stops and asks for downloading a (fake) flash player to continue the preview,” explained Faghani in a post to the Full Disclosure mailing list.
“The fake flash player is the downloader of the actual malware. We have been monitoring this malware for the last two days where it could infect more than 110K users only in two days and it is still on the rise.”
According to Faghani, the key to this trojan is that once it infects someone’s account, it re-shares the clip while tagging up to 20 of their friends – a tactic that helps it spread faster than previous Facebook-targeted malware that relied on one-to-one messaging on Facebook.
He dubbed this technique “Magnet” and warned that the trojan can hijack victims’ keyboard and mouse movements.
It’s far from the first time spicy video clips have been used as bait for malware scams attempting to spread via Facebook. In July 2014, for example, security firm BitDefender issued a warning about a scam designed to look like a YouTube video of someone stripping in front of their we**am.
In a statement issued to the Threatpost blog, a Facebook spokesperson said the company was aware of the latest scam, and was working to stop it spreading further across its social network.
“We use a number of automated systems to identify potentially harmful links and stop them from spreading. In this case, we’re aware of these malware varieties, which are typically hosted as browser extensions and distributed using links on social media sites,” said the spokesperson.
“We are blocking links to these scams, offering cleanup options, and pursuing additional measures to ensure that people continue to have a safe experience on Facebook.”
