Facebook remains the preferred target for cybercriminals specializing in stealing social network account credentials. According to Kaspersky Lab statistics, in the first quarter of 2014, fake sites imitating Facebook accounted for 10.85% of all phishing incidents, based on the activation of the Anti-phishing heuristic function in the company's products. Overall, most phishing alerts on the Internet concerned fake Yahoo pages, but Facebook was the main target among social networking sites.
Today, scams via Facebook constitute a global «business activity» and attacks against it are carried out in various languages such as English, French, German, Portuguese, Italian, Turkish, Arabic, etc.
Unauthorized access to Facebook accounts or any other social network can be used to spread phishing links or malware. Cybercriminals also use compromised accounts to send spam messages to victims’ contact lists. They also post spam messages on the “walls” of victims’ friends, where they can be seen by other users, or forward messages asking their friends for urgent financial help. Compromised accounts can also be used to gather information about specific individuals. This information is then used during targeted attacks in the future.
Smartphone or tablet users who visit social media sites on their mobile devices are also at risk of having their personal information stolen. The situation is made even worse by the fact that some mobile browsers hide the address bar when opening a website, making it much more difficult for users to spot fake sites.
«Digital criminals have developed many ways to lure their victims to websites with phishing content. They send links to phishing sites via email, through social networks or with banners placed on third‑party resources. Scammers often entice their victims with promises of «interesting content». When users follow these links, they are taken to a fake page that contains a specific message, asking them to log in before they can see its content. If users are not suspicious and fill in their details, their data will be sent immediately to the digital criminals», said Nadezhda Demidova, Web Content Analyst of Kaspersky Lab.».
What do the experts advise?
- If you receive a notification via email from Facebook or a message that your account may be blocked, never type your details into any form contained in that message. Facebook never asks users to enter their password in any email or to send their credentials via email.
- Place your cursor over the link and check if it leads to the official Facebook page. Additionally, you should manually type the Facebook URL into your browser, as digital criminals have the ability to hide the addresses they direct you to.
- After you type the Facebook URL, check again once the page loads to ensure it is not fake.
- Remember that Facebook uses the HTTPS protocol to transmit data. The absence of a secure connection likely means you have visited a fake site, even if the URL appears to be legitimate.
More information is available on the website securelist.com.
