Security News New multi platform malware/adware spreading via Facebook Messenger

[frogboy]

One good thing about having a lot of Facebook friends is that you simply act as a honey pot when your friends click on malicious things. A few days ago I got a message on Facebook from a person I very rarely speak to, and I knew that something fishy was going on.

After just a few minutes analyzing the message, I understood that I was just peeking at the top of this iceberg. This malware was spreading via Facebook Messenger, serving multi platform malware/adware, using tons of domains to prevent tracking, and earning clicks. The code is advanced and obfuscated.

Here is a screenshot of the JavaScript, an potential injector. Filename is “injection.js” (ebc117c0cf03ad4b13184d1253862586)

Full Article. New multi platform malware/adware spreading via Facebook Messenger

 

[Atlas147]

Happened to me several years ago, up till this day I'm still not sure if my friend was hacked or was she posting malicious files on purpose.

Got a message from someone I rarely speak to asking me to try a some "new software" that her team was developing for a free voucher, responded and asked for the link, downloaded the file and then ran it through virustotal, came back with 9/52 engines detected as malware. Uploaded the file to malwarehub and let it spread to the other AVs, I'm pretty sure at least 40 of the engines detect it was malware now

 

[Deleted member 65228]

Happened to me several years ago, up till this day I'm still not sure if my friend was hacked or was she posting malicious files on purpose.

There is a 90%> chance that she was infected because if she wasn't she would be infecting people while allowing everyone to be aware that she was responsible for any damages... Which would not end nicely for both personal relationships and legal reasons!

In 2010 I had a strange infection (for me at the time) which would replace messages I try to send with links to inappropriate websites on sites like Facebook. Really embarrassing!!

 

[NikolayfromRussia]

I don't use a facebook/twitter accounts. However I created about 10 facebook accounts some years ago but now they ask me to confirm them by giving my mobile number to which a sms will be sent. I don't want to give them my mobile number.
It is a good article posted by frogboy to be awared of such malwares.

 

[Weebarra]

Thankfully it wasn't you personally @frogboy, it just shows how easily something like this spreads and although i opened a FB account, i have no friends (on purpose) so at least i won't be a happy clicker nor do i read any messages that are on it, lol.

I don't use a facebook/twitter accounts. However I created about 10 facebook accounts some years ago but now they ask me to confirm them by giving my mobile number to which a sms will be sent. I don't want to give them my mobile number.
It is a good article posted by frogboy to be awared of such malwares.

I'm pretty sure that mine asked for a phone number and i just dismissed that message, i certainly didn't give one to them, in fact, i don't even use my real name

 

[SaharS]

https://www.linkedin.com/pulse/new-multi-platform-malwareadware-spreading-via-facebook-sahar-shukrun

i have published the Facebook malware's source-code (not the malicious extension but the actual script that operates on facebook) if any of you are interested.
I got it while one of the .bid servers response status was 302 hence giving me the script location in the server, which then was easy to get.