Malware spread as Facebook photo tag notification

Be wary of emails claiming to be from Facebook, and saying that you have been tagged in a photograph.

Because it might be that you're the next potential victim of a malware attack.

SophosLabs has intercepted a spammed-out email campaign, designed to infect recipients' computers with malware.

Here is an example of what a typical email can look like:

Subject: Christine McLain Gibbs tagged a photo of you on Facebook
From: Facebook <notification@faceboook.com>

(Did you notice what was odd about the email? The 'from' address misspells Facebook as "Faceboook" with three "o"s)

If you click on the link in the email, you are not taken immediately to the real Facebook website.

Instead, your browser is taken to a website hosting some malicious iFrame script (which takes advantage of the Blackhole exploit kit, and puts your computer at risk of infection by malware).

To act as a smokescreen, however, within four seconds your browser is taken via a META redirect to the Facebook page of a presumably entirely innocent individual.

SophosLabs are adding detection of the malware as Troj/JSRedir-HW.

Please be on your guard. You would have been protected from this threat if you had kept your wits about you.

Even if you didn't notice that "Faceboook" was spelt incorrectly, you could have seen by hovering your mouse over the link that it wasn't going to take you directly to the genuine Facebook website.

If you don't take the right steps to protect your computer, one day a cybercriminal might find the right social engineering trick to dupe you into making a bad decision or visit a dangerous website.

SophosLabs is still investigating this attack, and we will publish any further information here in due course.

by Graham Cluley on July 17, 2012 

_{Fly image, courtesy of Shutterstock.}