Research

Spammy Facebook friends from the neighborhood

Recently I stumbled upon some spam-ads on Facebook, which didn’t look very unusual at first glance.

It’s common for spammers to rely on social engineering techniques. They typically creating fake profiles, joining random open (or closed) groups and share links to shady e-commerce sites or survey-scams – always with catchy claims to lure the readers to click on the advertised link.

In this particular case, things are a bit different. The spammers created fake profiles featuring a nice profile photo of a young woman. But when you take a closer look at the About-page of “her” profile, you’ll notice she’s residing in the beautiful village of Ernersdorf in Bavaria (which is actually not far away from the Kaspersky Lab local office). I was somewhat surprised by this, because Addison is a very unusual name for a person living in such a small Bavarian village. And, according to her profile, she’s actually male and was born in September 1978. So I took a closer look.

Spammers Facebook Profile About-Page

Spammers Facebook Profile About-Page

It seems the spammers strategically chose this Bavarian Village and began to send out friend-requests to several people from that region. And since I grew up in this region, some of my friends on Facebook were successfully lured into accepting the fake friend requests.

Then nothing happened for several months. A few days ago, these spammers, now equipped which a level of credibility, started posting photos advertising an online-shop for sunglasses from a big brand – most likely fake versions. And finally, to improve spreading of the picture-ads, the spammers tagged their new “friends” from nearby.

Picture Spam on facebook

Picture Spam on Facebook

To prevent other people from using your profile for spamming all of your friends with that “technique”, you can adjust your Facebook settings for “Timeline and Tagging” like I did.

Facebook Timeline and Tagging Settings

Facebook Timeline and Tagging Settings

Also, please keep in mind that you don’t necessarily have to fall into this “nearby friends” trap to get you and your friends spammed like that. If spammers steals your real friends’ account-credentials somehow, it also could happen like in this case.

Spammy Facebook friends from the neighborhood

Your email address will not be published. Required fields are marked *

 

Reports

APT trends report Q2 2021

This is our latest summary of advanced persistent threat (APT) activity, focusing on significant events that we observed during Q2 2021: attacks against Microsoft Exchange servers, APT29 and APT31 activities, targeting campaigns, etc.

LuminousMoth APT: Sweeping attacks for the chosen few

We recently came across unusual APT activity that was detected in high volumes, albeit most likely aimed at a few targets of interest. Further analysis revealed that the actor, which we dubbed LuminousMoth, shows an affinity to the HoneyMyte group, otherwise known as Mustang Panda.

WildPressure targets the macOS platform

We found new malware samples used in WildPressure campaigns: newer version of the C++ Milum Trojan, a corresponding VBScript variant with the same version number, and a Python script working on both Windows and macOS.

Ferocious Kitten: 6 years of covert surveillance in Iran

Ferocious Kitten is an APT group that has been targeting Persian-speaking individuals in Iran. Some of the TTPs used by this threat actor are reminiscent of other groups, such as Domestic Kitten and Rampant Kitten. In this report we aim to provide more details on these findings.

Subscribe to our weekly e-mails

The hottest research right in your inbox