Facebook Warning: A New Email Virus Making The Rounds

Most Facebook users will be familiar with their web based message inbox. From an end user perspective, it looks similar to e-mail in many ways. However, it can only receive messages from approved friends. Well now it has another similarity with e-mail as it’s being used in an attempt to distribute a Trojan.

According to Marc Saltzman’s blog post, a message arrives in the message inbox from an approved Facebook friend with the message “LOL, You’ve been catched on hidden cam, yo.”. Marc states:

Following this messages is a long URL (website address) that, when clicked, takes you to what appears to be a YouTube video. This is not YouTube. When you click the video to begin, a message pops up and says you first need to download a newer Flash player to play the video. Do not do this. It’s a virus.

Symantec detect the downloaded file as the Infostealer.Gampass Trojan. The virus itself isn’t anything new or out of the ordinary. However, the delivery mechanism of using the Facebook Message Inbox is a clever Social Engineering technique that could result in a large number of infections.

So the question is, how did the messages appear to come from approved friends? As I was writing this blog post, I found this news article with a warning from Kaspersky:

When owners of the infected machines next log onto the social networks, their machine automatically sends the malicious messages out to new victims grabbed from the friend list, said Ryan Naraine, security evangelist at Kaspersky.

If you receive this message from a friend be sure to delete it and notify your friend that they have been infected by a virus.