A dangerous scam appears to be circulating on Facebook, using more sophisticated social engineering tactics to force victims to install malware.
The scam uses a video as a lure, which is suggested by a Facebook friend of the victim through a regular post.
In most cases, this is enough incentive to click on the message, but some users may not fall for the trap when they are redirected to a malicious page asking them to update their Flash Player in order to access the material. Therefore, the scammers created a fake YouTube page for the video that appears to show a woman undressing in front of a camera.
The fake page resembles YouTube and shows an impressive number of viewers (around 1.4 million), who have also liked or disliked the clip. Spotting the scam is easy if the user checks the URL, as it points to a different domain than the one used by Google's video service.
According to Bitdefender, which analyzed the malicious campaign, the crooks created more than 20,000 unique URLs redirecting potential victims to strange websites.
Cybercrooks managed to get their hands on over 60 bit.ly API keys that allow the creation of shortened links and are being used to spread the scam on Facebook. bit.ly has been notified of the abuse.
The fake Flash Player update is actually a Trojan detected by Bitdefender security software as Trojan.Agent.BDYV. Once executed, a password-protected file is injected into the system along with a BAT file that launches the executable by providing the necessary password to open it.
Because the malware can access data stored in web browsers, tag Facebook friends at the same time, and funnel advertising services to the page to increase the lifespan of the scam, Bitdefender informed via email. Additionally, it appears that users cannot delete the messages distributing the malicious redirects.
The security firm says the perpetrators may be from Albania, based on analysis of malicious code samples. The malware, which relies on an additional framework, is written to ensure compatibility with multiple web browsers, including Google Chrome and Mozilla Firefox.
