Security researchers at Trend Micro have identified a new spam campaign that aims to trick unsuspecting internet users into giving up their account credentials.
The fake announcements, which purport to come from the Facebook Chat Team, state that all Chat Boxes must be verified before May 24, 2014, in order to avoid being blocked under the SOPA and PIPA Acts. Any chats that are not verified will be terminated, the messages state.
The fake notifications contain links to a document on Pastebin, which contains instructions on how to verify the chat. Victims are asked to run some code in their browser's JavaScript console to complete the process.
Once the code is executed, the scammers gain access to the victim's account. Although access to the account is limited, the attackers can post to the user's timeline, tag them, and subscribe to specific pages.
Facebook issued a statement warning users about the campaign:
“There is a popular scam that promises users various benefits (such as illegal access to a third-party account, access to a new Facebook feature, etc.) by asking them to paste a piece of code written in JavaScript into their browser console.”.
“By pasting this code, users are giving attackers access to their account. To prevent this, the console has begun to be gradually disabled in some browsers,” Facebook points out.
