Facebook malware

[TheMalwareMaster]

Good morning, it has been some time since this malware has been around, and I'd like to discuss about it with you. This malware usually tags you, and lots of other friends of the infected person in a post, containing a malicious link which seems to lead to an hard-content video, in order to invite you clicking on it. It can also post in groups, in private chats of create group conversations. I've seen few of these going around on posts, and I Also received some in private chats. I was told that, If you click on the link, a malicious application will be installed into Facebook and it will start spreading the malware (is this right?). How can this kind of malware be classified? Is this a Facebook exploit? How is this able to automatically install the application without asking? Thanks in advance

 

[Omnipotent]

I don't think it's an exploit in Facebook. It's probably a Facebook app that you gave permission to without realizing.

 

[_CyberGhosT_]

I am happy to say I dont FB, so I am at a loss on this one, but the way you describe it,
it sounds like a MITM style attack, mixed with some click jacking ?

 

[LabZero]

It is hard to say what kind of malware it is without being able to analyze it.
It seems to be a script malware, and I found something similar here:

Facebook 'Comment Tagging Malware' Spreading via Google Chrome

 

[_CyberGhosT_]

It is hard to say what kind of malware it is without being able to analyze it.
It seems to be a script malware, and I found something similar here:

Facebook 'Comment Tagging Malware' Spreading via Google Chrome

Thanks, that was a very educational article

 

[Bryan Lam]

To be honest with you, coming from the perspective of chrome...It SHOULD NOT infect or spread anything through or to facebook. Even without anti-virus or anti-malware it shouldn't happen, but there are always those exploits which people have access to. So it may be possible. Either way, stay safe guys

 

[TheMalwareMaster]

The main problem is that this is not like traditional malware: you can't just use a virtual machine and test it, because it's connected to the Facebook account. I believe it's not related to Windows itself and you can also get infected using mobile devices or other OS

 

[LabZero]

The main problem is that this is not like traditional malware: you can't just use a virtual machine and test it, because it's connected to the Facebook account. I believe it's not related to Windows itself and you can also get infected using mobile devices or other OS

Well I don't think that this malware is so mysterious if you consider that Javascript is enabled on Windows and Android browsers and others.

 

[Atlas147]

Usually facebook malware that post spam for you without your knowledge is due to a rouge app like that @xCharbz said. But the content in the post are all sorts of different malware like trojans or keyloggers that affect you outside facebook because the end goal is still to gather information from infected users.

 

[LabZero]

A possible scenario: .js (dropper) drops a payload through a "drive-by" attack, on Windows.
Regarding Android , I do not know how many vulnerabilities (even Javascript) has my old smartphone that does not receive "one"update from years...