Today has been quite a busy day for scammers. We have been tracking a global scam/spam run that targets Facebook users. The lure used in the run is a familiar one:
Facebook Password Reset Confirmation! Customer Support.
The email looks like the following [Just it won’t notify you it’s Spam, it’s my own Software 😉 ]:
The activity on this particular scam run has been global from the beginning. The malware in the attachment is pretty much what one would expect: downloaders, password-stealing Trojan, fake-AV, or bot stuff, depending on which one you got. Check out the Artemis map of this malware:
To give you an idea of the scope of the run, it reached as high as No. 6 (!) on McAfee Global Virus Map’s Top 10, which tracks consumer detections worldwide. It even accounts for as much as 10 percent of the infected email that our managed email SaaS unit is seeing. From the looks of the spams themselves they may be associated with the Cutwail or Rustock botnets, but that analysis is still ongoing.
As we had previously discussed in the past, social networking sites will continue to be a favorite social engineering lure for cybercriminals to distribute malware. Make sure you are protected and educated.
You can submit information about any fake Facebook email to the Facebook Security Team. Facebook also has a great security page that I recommend to all Facebook users.