New Wave of Malicious Spam Attack on Facebook

Websense Security Labs ThreatSeeker Network of the security firm Websense Inc. has detected a fresh campaign of malicious e-mail assaults on the popular social networking site Facebook.

In this latest malicious spam assault, "From:" address on the e-mails is spoofed by means of support@facebook.com so as to make the messages look legitimate to recipients.

Moving ahead to the text of the spoof e-mail, it commences with "Hey Cyberguy" and informs the recipient that in order to ensure the safety of customers, his password has been altered. It informs the recipient that the attached document contains his new password. Finally, the mail ends by thanking all the e-mail recipients on behalf of the Facebook Team.

The .zip file attached with the mail contains an .exe file. It is learnt that the .exe file has a detection rate of around 30% on VirusTotal, a free online malware and virus scan service. The .exe file attached with the e-mail links to two servers for downloading additional malicious files and connects the Bredolab botnet, suggesting that the attackers gain full control of the PC. Thus, they can easily steal customers' personal details and send spam e-mails. The servers that facilitate malicious downloads are located one each in the Netherlands and Kazakhstan.

In the meantime, Manager of Websense Security Labs, Carl Leonard, commented that this particular spam e-mail attack has been designed to target the topmost concern for the netizens, i.e. the security of their password. The victims of this scam could inadvertently end up in becoming part of a botnet, reported SCMAGAZINE on October 27, 2009.

Leonard further added that with the hack of Web-based e-mail accounts, netizens would be keen to open the attachment that claims to contain their new password, as they would be worried who altered it.

However, this is not the first incident of Websense detecting a malicious Facebook spam assault; in November 2008 also the security firm discovered a similar scam targeting users of the well-known social networking site.

This latest discovery by Websense underlines the point, which was brought into the notice by security firm MessageLabs in October 2009, regarding the steady increase in the percentage of spam related to the Bredolab Trojan in recent months.

Related article: New Zealand Releases Code To Reduce Spam

» SPAMfighter News - 11/5/2009