Facebook neutralizes phishing attack

Share this article:
Facebook said Thursday it has put the brakes on a phishing wave that was trying to dupe members into divulging their login credentials.

During the past two days, phishers sent messages to Facebook users that appeared to come from their "friends." However, the scammers actually had hacked those accounts, giving them the ability to send messages and impersonate the victim.

The emails they sent contained links to two sites -- fbstarter[com] or fbaction[net] -- that were designed to mimic the actual Facebook login screen, company spokesman Barry Schnitt told SCMagazineUS.com on Thursday.The crooks were trying to get recipients to give up their username and password to access Facebook.

Once Facebook learned of the attack, it blocked the scammers' content from being shared on Facebook, and the company changed the passwords on those profiles that had been sending the bogus messages.

"The passwords they've stolen are no longer valid [on Facebook]," Schnitt said. But, he added, the fraudsters may try to use the stolen goods on other websites, where individuals may use the same credentials as they do on Facebook.

Jamie Tomasello, abuse operations manager at message security firm Cloudmark, said the phishing campaign  could just as easily have been pushing links to malware-serving websites that were trying to, for example, trick users into downloading a trojan disguised as a plugin to view a video.

"The more users depend on social networking sites as a trusted source of communication, the more fraudsters are going to abuse it," Tomasello told SCMagazineUS.com on Thursday.

Schnitt said users should be on the lookout for similar scams. He reminded users that Facebook rarely logs them out, thus they would not always have to re-enter their login details. In addition, when being queried for username and password, users should look at the address bar to ensure they are at the legitimate site.

Schnitt said he did not know how many people fell victim. Facebook boasts as many as 200 million active users.
Share this article:

Sign up to our newsletters

More in News

EFF intros wireless router software to boost industry standard

EFF intros wireless router software to boost industry ...

This weekend, the digital rights group released a "hacker alpha" version of its Open Wireless Router software.

Breaches driving organizational security strategy, survey indicates

Breaches driving organizational security strategy, survey indicates

CyberArk interviewed 373 IT security executives and other senior management in North America, Europe and the Asia-Pacific as part of its eighth annual Global Advanced Threat Landscape survey.

Siemens industrial products impacted by four OpenSSL vulnerabilities

The vulnerabilities can be exploited remotely, and fairly easily, by an attacker to hijack sessions and crash the web server of the product.