Incidents

Facebook profile: No, it doesn’t work!

We are currently investigating a new malicious campaign on Facebook mostly targeting French speaking users found by our expert researcher Nicolas Brulez. When visiting infected users profiles, one can see the following:

Translation: Wow, it really works! Find out who is viewing your profile!

The links rotates quite fast and leads you to a website which explains to the victims what they need to do. Here is what it looks like:

Basically, there are 2 steps.
• The first one is to copy Javascript code using CTRL+C
• The second one is to visit Facebook.com and to paste the Javascript in your address bar and press the “Enter”key.
In order to make sure their victim is successful, they made an animation file (GIF) describing every step in detail. They want to infect users with limited computer knowledge too. They warn the users that it can take up to 1 minute to process.
Once done, the affected users will spread the campaign on their own walls.
Interestingly, they added a statistic service on the various sites offering the “how to be a victim” page. This page offers quite a lot of interesting information.
For example, here is a graph of the number of visits in the past 24 hours:

We learn that it started to take off around 9pm last night and that it is currently growing fast.
As I am writing this blog, there are currently 2266 visitors on the instruction pages.
Here is a map describing the location of the visitors:

Its obvious France is the center of epidemic right now.
I would like to remind all of you that you can’t see who visited your profile, be it on Facebook or Twitter.
You should avoid all those magical applications or websites like the plague, they don’t work and lead to infection. It’s not new, back in the day, there were fake websites asking for your IM credentials in order to reveal who is blocking you. In fact, you were freely giving criminals your login and password.
IT DOES NOT WORK!!

Facebook profile: No, it doesn’t work!

Your email address will not be published. Required fields are marked *

 

Reports

Focus on DroxiDat/SystemBC

An unknown actor targeted an electric utility in southern Africa with Cobalt Strike beacons and DroxiDat, a new variant of the SystemBC payload. We speculate that this incident was in the initial stages of a ransomware attack.

APT trends report Q2 2023

This is our latest summary of the significant events and findings, focusing on activities that we observed during Q2 2023.

Meet the GoldenJackal APT group. Don’t expect any howls

GoldenJackal is an APT group, active since 2019, that usually targets government and diplomatic entities in the Middle East and South Asia. The main feature of this group is a specific toolset of .NET malware, JackalControl, JackalWorm, JackalSteal, JackalPerInfo and JackalScreenWatcher.

Subscribe to our weekly e-mails

The hottest research right in your inbox