Security researchers have identified an interesting phishing scam for Facebook. A fake Facebook is designed not only to collect user credentials and passwords, but also to distribute malware.
It all starts with a fake Facebook page advertising an app that supposedly can tell users who has visited their profile. To activate the app, victims will need to log in to their Facebook account, or download a piece of software.
The malware is hidden within a fake profile designed to steal information from compromised computers. This threat was identified by Symantec as Infostealer.
Once the malware is installed on a device, it adds registry keys to ensure it runs on every boot. It then creates a keylogger to steal information, which it sends back to a specific email address.
Fortunately, the email address currently used by the Trojan is no longer valid. However, this can change at any time, so Facebook users are advised to be cautious.
