Facebook profile: No, it doesn’t work!

We are currently investigating a new malicious campaign on Facebook mostly targeting French speaking users found by our expert researcher Nicolas Brulez. When visiting infected users profiles, one can see the following:

Translation: Wow, it really works! Find out who is viewing your profile!

The links rotates quite fast and leads you to a website which explains to the victims what they need to do. Here is what it looks like:

Basically, there are 2 steps.
• The first one is to copy Javascript code using CTRL+C
• The second one is to visit Facebook.com and to paste the Javascript in your address bar and press the “Enter”key.
In order to make sure their victim is successful, they made an animation file (GIF) describing every step in detail. They want to infect users with limited computer knowledge too. They warn the users that it can take up to 1 minute to process.
Once done, the affected users will spread the campaign on their own walls.
Interestingly, they added a statistic service on the various sites offering the “how to be a victim” page. This page offers quite a lot of interesting information.
For example, here is a graph of the number of visits in the past 24 hours:

We learn that it started to take off around 9pm last night and that it is currently growing fast.
As I am writing this blog, there are currently 2266 visitors on the instruction pages.
Here is a map describing the location of the visitors:

Its obvious France is the center of epidemic right now.
I would like to remind all of you that you can’t see who visited your profile, be it on Facebook or Twitter.
You should avoid all those magical applications or websites like the plague, they don’t work and lead to infection. It’s not new, back in the day, there were fake websites asking for your IM credentials in order to reveal who is blocking you. In fact, you were freely giving criminals your login and password.
IT DOES NOT WORK!!