Facebook account cancellation malware poses as Adobe Flash update — Forum

Haggis The Haggis Member #272

May 22, 2012 1:42 PM

#79,986

Have you received an email asking you to confirm that you wish to cancel your account?

Be on your guard.

Some people have been receiving emails - seemingly from Facebook.

Hi

We are sending you this email to inform you that we have received an account cancellation request from you. Please follow the link below to confirm or cancel this request

Thanks,

The Facebook Team

To confirm or cancel this request, follow the link below:

click here

The link doesn't point to an official Facebook page, but a third-party application running on the Facebook platform. Of course, that means that the link *does* go to a facebook.com address - something might fool those who are not cautious.

The first thing you're likely to encounter if you did click on the link is a message asking you if you want to allow an unknown Java applet to run on your computer.

And it seems they're pretty insistent that you allow it.. If you hit the "No thanks" button they'll just carry on pestering you to allow the Java applet to run.

The social engineering being used by the tricksters behind this malware attack is pretty cunning. They know that people value their Facebook accounts highly, and many would be upset to lose access to them and the digital connections they have built up with friends and family.

The hope of the cybercriminals is that victims will blindly agree to whatever the computer tells them to do, in order to "fix" the account cancellation request.

If you do allow the applet to run, you will see a message telling you that Adobe Flash must be updated.

Of course, the code that is downloaded is not really Adobe Flash at all. Instead, the program drops additional files into your /WIN32 folder, which have the intention of allowing remote hackers to spy on your activities and take control of your computer.

Source: http://nakedsecurity.sophos.com

Spam Honeypot - http://www.haggistech.co.uk/honey(humans do not register)