Trend Micro researchers have witnessed several Facebook wall posts that claim to have the ability to verify the security of users'accounts. Clicking the link to the verification site, according to the posts, is supposed to help the users avoid Facebook spam. In reality, however, accessing the site is just another ploy to instigate the very same threat that the user wants to prevent.
Similar to previously reported Facebook threats, this spam run starts from a wall post supposedly made by an online contact. The post encourages the users to verify the safety of their Facebook accounts by clicking an embedded link with the text, VERIFY MY ACCOUNT Clicking the link immediately redirects the users to a site that runs a specific malicious script.
The script collates a list of the affected users' Facebook contacts and displays the same text on their walls. Detected by Trend Micro as JS_DOOLF.SPM, the script also displays an alert that says Verification Failed. Click OK and follow the steps to prevent your account from being deleted.
In the past few days, Facebook played host to a string of malicious attacks involving a fake Osama bin Laden video, an event that leads to a site that supposedly allows users to see who has viewed their profiles, and a spam that uses several Facebook features to spread malicious links. These incidents led Facebook users to question the safety and security of the social networking site.
Amit Nath, Country Manager - India and SAARC, Trend Micro, commented, "Never Click Links in messages received unexpectedly and never ever login to a site as a result of a link in a message. If you do follow a link that instructs you to login afterwards, close the page, then open a new page and visit the site using a previously bookmarked or known good link. Use a unique strong password for each account. If you have multiple social networking accounts, use a unique password for each."
