Emails claiming to be from Facebook, stating that the recipient's account has been temporarily disabled, have been observed distributing a link to a malicious file.
Cybercriminals often rely on this topic as bait since there is a high chance that the recipient of the message has an account on the major social media website.
In this case, the reason for the alleged account suspension is a renewal of Facebook's terms and policies, which makes changes to its policies, but once the user logs into their account, they appear as updates. This is to ensure that Facebook users will see and be informed of the new data on the site.
The malicious message circulating online contains a link where the user can access the new information. However, according to OTA, it redirects the user to a file hosted on assetdigitalmarketing [..]com, a domain that exists to distribute malicious scripts to victims' computers.
The file downloaded from this location has a double extension (TermsPolicies.pdf.exe), and appears to be a PDF, even with the appropriate image attached, but a closer look reveals the true nature of the file, which is actually an executable file.
The scam has a high success rate on Windows where file extensions are not visible, because it appears as a regular PDF.
