Incidents

Facebook profile: No, it doesn’t work!

We are currently investigating a new malicious campaign on Facebook mostly targeting French speaking users found by our expert researcher Nicolas Brulez. When visiting infected users profiles, one can see the following:

Translation: Wow, it really works! Find out who is viewing your profile!

The links rotates quite fast and leads you to a website which explains to the victims what they need to do. Here is what it looks like:

Basically, there are 2 steps.
• The first one is to copy Javascript code using CTRL+C
• The second one is to visit Facebook.com and to paste the Javascript in your address bar and press the “Enter”key.
In order to make sure their victim is successful, they made an animation file (GIF) describing every step in detail. They want to infect users with limited computer knowledge too. They warn the users that it can take up to 1 minute to process.
Once done, the affected users will spread the campaign on their own walls.
Interestingly, they added a statistic service on the various sites offering the “how to be a victim” page. This page offers quite a lot of interesting information.
For example, here is a graph of the number of visits in the past 24 hours:

We learn that it started to take off around 9pm last night and that it is currently growing fast.
As I am writing this blog, there are currently 2266 visitors on the instruction pages.
Here is a map describing the location of the visitors:

Its obvious France is the center of epidemic right now.
I would like to remind all of you that you can’t see who visited your profile, be it on Facebook or Twitter.
You should avoid all those magical applications or websites like the plague, they don’t work and lead to infection. It’s not new, back in the day, there were fake websites asking for your IM credentials in order to reveal who is blocking you. In fact, you were freely giving criminals your login and password.
IT DOES NOT WORK!!

Facebook profile: No, it doesn’t work!

Your email address will not be published. Required fields are marked *

 

Reports

The leap of a Cycldek-related threat actor

The investigation described in this article started with one such file which caught our attention due to the various improvements it brought to this well-known infection vector.

Lazarus targets defense industry with ThreatNeedle

In mid-2020, we realized that Lazarus was launching attacks on the defense industry using the ThreatNeedle cluster, an advanced malware cluster of Manuscrypt (a.k.a. NukeSped). While investigating this activity, we were able to observe the complete life cycle of an attack, uncovering more technical details and links to the group’s other campaigns.

Sunburst backdoor – code overlaps with Kazuar

While looking at the Sunburst backdoor, we discovered several features that overlap with a previously identified backdoor known as Kazuar. Our observations shows that Kazuar was used together with Turla tools during multiple breaches in past years.

Subscribe to our weekly e-mails

The hottest research right in your inbox