Facebook profile: No, it doesn’t work!

We are currently investigating a new malicious campaign on Facebook mostly targeting French speaking users found by our expert researcher Nicolas Brulez. When visiting infected users profiles, one can see the following:

Translation: Wow, it really works! Find out who is viewing your profile!

The links rotates quite fast and leads you to a website which explains to the victims what they need to do. Here is what it looks like:

Basically, there are 2 steps.
• The first one is to copy Javascript code using CTRL+C
• The second one is to visit and to paste the Javascript in your address bar and press the “Enter”key.
In order to make sure their victim is successful, they made an animation file (GIF) describing every step in detail. They want to infect users with limited computer knowledge too. They warn the users that it can take up to 1 minute to process.
Once done, the affected users will spread the campaign on their own walls.
Interestingly, they added a statistic service on the various sites offering the “how to be a victim” page. This page offers quite a lot of interesting information.
For example, here is a graph of the number of visits in the past 24 hours:

We learn that it started to take off around 9pm last night and that it is currently growing fast.
As I am writing this blog, there are currently 2266 visitors on the instruction pages.
Here is a map describing the location of the visitors:

Its obvious France is the center of epidemic right now.
I would like to remind all of you that you can’t see who visited your profile, be it on Facebook or Twitter.
You should avoid all those magical applications or websites like the plague, they don’t work and lead to infection. It’s not new, back in the day, there were fake websites asking for your IM credentials in order to reveal who is blocking you. In fact, you were freely giving criminals your login and password.

Facebook profile: No, it doesn’t work!

Your email address will not be published. Required fields are marked *



Lyceum group reborn

According to older public researches, Lyceum conducted operations against organizations in the energy and telecommunications sectors across the Middle East. In 2021, we have been able to identify a new cluster of the group’s activity, focused on two entities in Tunisia.

GhostEmperor: From ProxyLogon to kernel mode

While investigating a recent rise of attacks against Exchange servers, we noticed a recurring cluster of activity that appeared in several distinct compromised networks. With a long-standing operation, high profile victims, advanced toolset and no affinity to a known threat actor, we decided to dub the cluster GhostEmperor.

APT trends report Q2 2021

This is our latest summary of advanced persistent threat (APT) activity, focusing on significant events that we observed during Q2 2021: attacks against Microsoft Exchange servers, APT29 and APT31 activities, targeting campaigns, etc.

Subscribe to our weekly e-mails

The hottest research right in your inbox