Research

Spammy Facebook friends from the neighborhood

Recently I stumbled upon some spam-ads on Facebook, which didn’t look very unusual at first glance.

It’s common for spammers to rely on social engineering techniques. They typically creating fake profiles, joining random open (or closed) groups and share links to shady e-commerce sites or survey-scams – always with catchy claims to lure the readers to click on the advertised link.

In this particular case, things are a bit different. The spammers created fake profiles featuring a nice profile photo of a young woman. But when you take a closer look at the About-page of “her” profile, you’ll notice she’s residing in the beautiful village of Ernersdorf in Bavaria (which is actually not far away from the Kaspersky Lab local office). I was somewhat surprised by this, because Addison is a very unusual name for a person living in such a small Bavarian village. And, according to her profile, she’s actually male and was born in September 1978. So I took a closer look.

Spammers Facebook Profile About-Page

Spammers Facebook Profile About-Page

It seems the spammers strategically chose this Bavarian Village and began to send out friend-requests to several people from that region. And since I grew up in this region, some of my friends on Facebook were successfully lured into accepting the fake friend requests.

Then nothing happened for several months. A few days ago, these spammers, now equipped which a level of credibility, started posting photos advertising an online-shop for sunglasses from a big brand – most likely fake versions. And finally, to improve spreading of the picture-ads, the spammers tagged their new “friends” from nearby.

Picture Spam on facebook

Picture Spam on Facebook

To prevent other people from using your profile for spamming all of your friends with that “technique”, you can adjust your Facebook settings for “Timeline and Tagging” like I did.

Facebook Timeline and Tagging Settings

Facebook Timeline and Tagging Settings

Also, please keep in mind that you don’t necessarily have to fall into this “nearby friends” trap to get you and your friends spammed like that. If spammers steals your real friends’ account-credentials somehow, it also could happen like in this case.

Spammy Facebook friends from the neighborhood

Your email address will not be published. Required fields are marked *

 

Reports

Operation TunnelSnake

A newly discovered rootkit that we dub ‘Moriya’ is used by an unknown actor to deploy passive backdoors on public facing servers, facilitating the creation of a covert C&C communication channel through which they can be silently controlled. The victims are located in Africa, South and South-East Asia.

APT trends report Q1 2021

This report highlights significant events related to advanced persistent threat (APT) activity observed in Q1 2021. The summaries are based on our threat intelligence research and provide a representative snapshot of what we have published and discussed in greater detail in our private APT reports.

The leap of a Cycldek-related threat actor

The investigation described in this article started with one such file which caught our attention due to the various improvements it brought to this well-known infection vector.

Subscribe to our weekly e-mails

The hottest research right in your inbox