There are many people who would give anything for a tool that allows them to hack into their friends' Facebook. Scammers are well aware of this hidden desire, which is why they often trick users of the popular social network into taking specific actions with the promise of a hacking tool.
Mr. Satnam Narang of Symantec has published a blog post to describe such a scheme. A group of Indian internet scammers have tried to trick users into handing over their account passwords. The scammers promise a Facebook account hacking tool that they supposedly designed for educational purposes.
Messages posted on social media ask victims to copy a piece of code, paste it into their browser's JavaScript console and run it. The scammers tell victims that they must wait up to two hours for the password they want to be sent to them.
However, no one gets the passwords. The tool works, but the actual hacking is done on the Facebook account of the person using it. By running the code provided by the cybercriminals, users unknowingly give up access to their accounts.
The code is designed to Like various pages and Follow various lists on behalf of the scammers. In addition, comments are posted in which the victim's friends are tagged and in which the Facebook hacking tool is advertised. In this way, the scammers attract the attention of more members of the social network.
This type of attack is called self-XSS and has been around since around 2011. Facebook is aware of these schemes. The company has disabled the JavaScript console to protect users from this type of scam.
Experts say the hackers behind this hack are based in India. They have even publicly discussed their operation, calling it “ethical hacking,” justifying their actions by saying they are hacking into users who would like to become malicious hackers.
Users who have fallen victim to this or similar scams should visit and review their social media activity logs to see which pages they have liked on behalf of the scammers. They should remove all comments and posts posted by the hackers. Victims are also advised to warn their friends to ensure they do not fall victim to the scam as well.
