Researchers from ESET are today revealing their discovery of a new Facebook scam campaign that spreads a malicious browser plugin via social engineering techniques. The attack starts by luring a Facebook user into playing a video, most often titled “My first video”, “My video” or “Private video”. After clicking on the link, the victim is directed to a fake YouTube website where, instead of downloading and playing the video, he/she is requested to install an additional extension. The extension is a malicious version of the otherwise legitimate “Make a GIF” plug-in.
If the victim installs the malicious plug-in, his/her browser becomes infected and carries the infiltration further: his/her Facebook wall becomes flooded with fake video posts tagging multiple friends from their friends list and subsequently, all online friends will receive an identical message via Messenger with the same harmful contents.
At the beginning of April, 2016, ESET systems detected this threat more than 10,000 times in dozens of countries around the world, including the UK, United States, Canada, Australia, New Zealand, Russia, Slovakia, the Czech Republic, Germany, Switzerland, Poland, India, Dubai, Singapore, Norway, Greece, Hungary, the Republic of the Philippines, Turkey, Israel, Peru, Thailand, Argentina and many other regions.
Full details on ESET’s discovery can be found on their We Live Security blog: http://www.welivesecurity.com/2016/04/14/my-video-my-first-video-private-video-dont-fall-for-this-facebook-scam
