View all newsletters
Receive our newsletter - data, insights and analysis delivered to you
  1. Technology
  2. Cybersecurity
October 10, 2013

Bogus Facebook page spreading malware

Researchers say ‘criminals are using the site to mount a two-pronged attack against their victims

By Ben Sullivan

Two Symantec researchers have spotted a bogus Facebook page duping victims into downloading data stealing malware.

Researchers Avdhoot Patil and Daniel Regalado Arias reported uncovering the scam in a blog post, warning the criminals are using the site to mount a two-pronged attack against their victims.

"The phishing site boasted that the application would enable users to view a list of people who visited their profile page. The site offered two options to activate the fake app. The first option was by downloading software containing the malware and the second was by entering user credentials and logging into Facebook," read the post.

"A message on the phishing page encouraged users to download the software that would allegedly send notifications to the user when someone visited their Facebook profile. If the download button was clicked, a file download prompt appeared. The file contained malicious content detected by Symantec as Infostealer. On the other hand, if user credentials were entered, the phishing site redirected to a legitimate Facebook page."

The researchers noted the use of the malware as particularly troubling as it has the potential to grant the criminals several espionage and data theft powers.

"Symantec analyzed the malware and found its behavior to be as follows: The malware consists of two executable files that both perform the same action. The files are added to the registry run key, which execute after every reboot. The malware sets up a keylogger in order to track anything that the victim types," read the post.

"Then, it will check if there is internet connectivity by pinging If there is connectivity, the malware will send all information gathered to the attacker’s email address. Symantec observed that the email address has not been valid for three months and hence the malware is not able to send updates to the attacker at the moment."

Content from our partners
Scan and deliver
GenAI cybersecurity: "A super-human analyst, with a brain the size of a planet."
Cloud, AI, and cyber security – highlights from DTX Manchester

Websites in our network
Select and enter your corporate email address Tech Monitor's research, insight and analysis examines the frontiers of digital transformation to help tech leaders navigate the future. Our Changelog newsletter delivers our best work to your inbox every week.
  • CIO
  • CTO
  • CISO
  • CSO
  • CFO
  • CDO
  • CEO
  • Architect Founder
  • MD
  • Director
  • Manager
  • Other
Visit our privacy policy for more information about our services, how Progressive Media Investments may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.