FB spam that claims to 'prevent' spam leading to spam

BANGALORE, INDIA: Trend Micro Researchers have discovered several Facebook wall posts that claim to have the ability to verify the security of users’ accounts. However, clicking on the link leads to  malicious sites that prompts the users share their account details or personal information.

According to researchers, this spam run starts from a wall post supposedly made by an online contact. The post encourages the users to verify the safety of their Facebook accounts by clicking an embedded link with the text, ==VERIFY MY ACCOUNT==. Clicking the link immediately redirects the users to a site that runs a specific malicious script.

Also read: 'Untag yourself' spam on FB

The script collates a list of the affected users’ Facebook contacts and displays the same text on their walls. Detected by Trend Micro as JS_DOOLF.SPM, the script also displays an alert that says Verification Failed. Click OK and follow the steps to prevent your account from being deleted.

According to Trend Micro researchers, in the past few days, Facebook played host to a string of malicious attacks involving a fake Osama bin Laden video, an event that leads to a site that supposedly allows users to see who has viewed their profiles, and a spam that uses several Facebook features to spread malicious links. These incidents led Facebook users to question the safety and security of the social networking site.

The alert also points to a document supposedly hosted on http://{BLOCKED}tenhe.info/verify.php?js, which is no longer accessible.

Amit Nath Country Manager India and SAARC Trend Micro commented "Never Click Links in messages received unexpectedly and never ever login to a site as a result of a link in a message. If you do follow a link that instructs you to login afterwards, close the page, then open a new page and visit the site using a previously bookmarked or known good link. Use a unique strong password for each account. If you have multiple social networking accounts use a unique password for each."

Reports say that the attack from which the campaign originates uses a different social engineering lure–a rather offensive message and a call to vote for a girl named Nicole Santos.