Facebook Suffers 'Password Reset' Scam

Today has been quite a busy day for scammers. We at McAfee Labs have been tracking a global scam/spam run that targets Facebook users. The lure used in the run is a familiar one:

Facebook Password Reset Confirmation! Customer Support.

The email looks like the following:

The activity on this particular scam run has been global from the beginning, and thanks to our Artemis “cloud” technology we have dealt with it very efficiently. The malware in the attachment is pretty much what one would expect: downloaders, password-stealing Trojan, fake-AV, or bot stuff, depending on which one you got. Check out the Artemis map of this malware:

To give you an idea of the scope of the run, it reached as high as No. 6 (!) on our Global Virus Map’s Top 10, which tracks consumer detections worldwide. It even accounts for as much as 10 percent of the infected email that our managed email SaaS unit is seeing. From the looks of the spams themselves they may be associated with the Cutwail or Rustock botnets, but that analysis is still ongoing.

As we had previously discussed in our 2010 Threat Predictions, social networking sites will continue to be a favorite social engineering lure for cybercriminals to distribute malware. Make sure you are protected and educated.

You can submit information about any fake Facebook email to the Facebook Security Team. Facebook also has a great security page that I recommend to all Facebook users.