A new Trojan circulating on Facebooklast week managed to spread to more than 110,000 users in just two days, a security researcher reports. It did this by tagging friends of victims' accounts in a post that led to an alleged video. This scam method is not new, but its frequency of use has increased recently.
Last week, Bitdefender, an antivirus software company in Romania, published an analysis of the scam, where 20 of the victim's friends were tagged in the fake post to act as bait for other users. In less than an hour, the post had spread to more than 5,000 accounts.
Clicking on the message would take the user to a page where they could see a preview of an adult video. This would stop after a few seconds, initially prompting the viewer to download a malicious file claiming to be an update for Flash Playerin order to view the rest of the clip. The download process would then begin automatically.
Mohammad Reza Faghani, discovered a similar scam, and according to his information, the number of victims is on the rise.
A report was released on Thursday, stating that the cybercriminals behind this Trojan rely on a more aggressive distribution method, which the researcher calls “Magnet,” where the victim’s friends of friends can also see the malicious post. In previous cases, the initial victim would send the post to their friends, and only if they clicked on the post could it spread to their contacts.
A brief analysis of the malicious scriptshows that the fake Flash Player version update brings a set of executable files (chromium.exe, wget.exe, arsiv.exe, verclsid.exe) to be installed on the system.
Fortunately, for now at least, several anti-virus programs can detect malware and prevent it from infecting the system.
