Facebook phishing scams are no longer uncommon, but each time experts encounter something different in their characteristics.
Researchers from security firm Trend Micro have discovered a new malware, which they have named TSPY_MINOCDO.A. The new malware is designed to modify local HOST files on infected computers and monitor browser activity. Of course, by manipulating the host file, it can redirect its victims to a fake Facebook page that requests a security check.
The malware, which runs every time the computer starts, waits for the user to visit the address www.facebook.com, or simply facebook.com. When it detects one of the addresses, victims are redirected to a page that informs them that “Security checks help keep Facebook safe and spam-free.”
The information requested by the page is name, address, phone number, and financial information.
To make sure their trap is well-hidden and functional, the attackers have designed the malware in such a way that it performs multiple DNS queries to different domain names associated with the phishing site.
If you encounter a page like the one in the screenshot, it is likely that your computer has already been infected with malware. If you have already provided your details to the malicious page, contact your bank immediately.
You should also scan your computer with a reliable anti-virus to get rid of malware.
