{"id":226083,"date":"2017-08-25T08:04:46","date_gmt":"2017-08-25T06:04:46","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=226083"},"modified":"2017-08-25T08:07:35","modified_gmt":"2017-08-25T06:07:35","slug":"watch-out-for-this-facebook-message-which-contains-malware","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/226083-watch-out-for-this-facebook-message-which-contains-malware.html","title":{"rendered":"Watch out for this Facebook message which contains malware"},"content":{"rendered":"

Security companies have warned that new multi-platform malware and adware is spreading through Facebook Messenger.<\/p>\n

David Jacoby at Kaspersky Lab said<\/strong><\/a>\u00a0he received a strange message on Facebook from a person he rarely speaks to.<\/p>\n

\u201cAfter analysing the message, I understood that I was just peeking at the top of this iceberg,\u201d said Jacoby.<\/p>\n

\u201cThis malware was spreading via Facebook Messenger, serving multi-platform malware and adware, using tons of domains to prevent tracking, and earning clicks. The code is advanced and obfuscated.\u201d<\/p>\n

The spreading mechanism appears to be Facebook Messenger, but how it spreads is unknown. \u201cIt may be from stolen credentials, hijacked browsers, or clickjacking. At the moment, we are not sure.”<\/p>\n

Message<\/h3>\n

The message reads \u201cPeter Video\u201d – as an example – with a bit.ly link – which hides the true URL.<\/p>\n

The link points to a Google doc. The document has already taken a picture from the victim\u2019s Facebook page and created a dynamic landing page which looks like a playable movie.<\/p>\n

When the victim clicks on the fake movie, the malware redirects them to a set of websites which enumerate their browser and operating system.<\/p>\n

Depending on their OS, they are directed to other websites.<\/p>\n

\u201cThis technique is not new. I would describe it as a domain chain – just a lot of websites on different domains redirecting the user depending on some characteristics.”<\/p>\n

\u201cWe know that clicking on unknown links is not recommended, but through this technique they basically force you to do so.\u201d<\/p>\n

Jacoby said the adware campaign is quite unique as it uses Google Docs, with customized landing pages, along with Facebook.<\/p>\n

\u201cPlease make sure you don\u2019t click on these links, and update your antivirus,\u201d said Jacoby.<\/p>\n

What to watch out for<\/h3>\n

An example of the malware message is below.<\/p>\n

\n

Facebook Message<\/h3>\n

\"Facebook\"<\/a><\/p>\n

\n

Google Doc Links<\/h3>\n

\"facebook\"<\/a><\/p>\n

\"Facebook\"<\/a><\/p>\n

\n

Other “Fake” Pages and Pop-ups<\/h3>\n

\"Fake<\/a><\/p>\n

\"Flash<\/a><\/p>\n

\"Fake\"<\/a><\/p>\n

\n

Now read:\u00a0Facebook Safety Check update announced<\/a><\/h3>\n","protected":false},"excerpt":{"rendered":"

Security companies have warned that new multi-platform malware is spreading through Facebook.<\/p>\n","protected":false},"author":23,"featured_media":226085,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[161,8887,799],"class_list":["post-226083","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-facebook","tag-facebook-messenger","tag-kaspersky-lab"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/226083"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/23"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=226083"}],"version-history":[{"count":1,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/226083\/revisions"}],"predecessor-version":[{"id":226115,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/226083\/revisions\/226115"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/226085"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=226083"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=226083"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=226083"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}