Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Privacy

Facebook ‘Clickjacking’ Leads Users to Make Unintended Recommendations

PandaLabs, the anti-malware laboratory of Panda Security, has reported a new proliferation of scams that highjack the Facebook “Like” option. The attacks use bogus messages that look like they’re from friends, with topics related to the popular game Farmville, the film Sex and the City 2 or simply the keyword “sex.” Unwary Facebook users who click on the links in these messages are taken to a Web page containing photos and videos of the relevant topic.

PandaLabs, the anti-malware laboratory of Panda Security, has reported a new proliferation of scams that highjack the Facebook “Like” option. The attacks use bogus messages that look like they’re from friends, with topics related to the popular game Farmville, the film Sex and the City 2 or simply the keyword “sex.” Unwary Facebook users who click on the links in these messages are taken to a Web page containing photos and videos of the relevant topic.

But, unbeknownst to those users, simply visiting that page causes a message to be displayed on their Facebook profile indicating that they “like” it, with a text that is not controlled by them.

This technique, known as “clickjacking,” uses a modified (and malicious) URL with embedded code to carry out the attack and trick users into “liking” a page without necessarily realizing that they are recommending it to all of their Facebook friends.

“This distribution technique reminds us of computer worms,” says Luis Corrons, Technical Director of PandaLabs. “Although at this time there doesn’t seem to be any malware behind it.”

According to Corrons, the real business stems from the pay-per-click system, which counts clicks and generates revenue for affiliates. “Cyber-criminals can make money just by tricking you into visiting a Web page with ads,” says Corrons. “Or worse still, they can spread malware and infect you. This possibility has not yet been exploited, but it would be relatively easy and effective to do it.”

PandaLabs advises users to be extremely wary of messages with striking subjects received from Facebook’s internal messaging system, and to take all necessary precautions when clicking the “Like” button on external Web pages. One good practice for users is to hover over the “Like” button on a non-Facebook page and look at the url that’s displayed. If it seems strange, it’s best not to click. Also, PandaLabs recommends that users refrain from entering any banking or credit card information in applications that try to sell them any kind of test.

Written By

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Expert Insights

Related Content

Cybersecurity Funding

Los Gatos, Calif-based data protection and privacy firm Titaniam has raised $6 million seed funding from Refinery Ventures, with participation from Fusion Fund, Shasta...

Cyberwarfare

U.S. fighter jets successfully shot down the high altitude spy balloon launched by and belonging to China.

Privacy

Meta was fined an additional $5.9 million for violating EU data protection regulations with WhatsApp messaging app.

Privacy

The EU's digital policy chief warned TikTok’s boss that the social media app must fall in line with tough new rules for online platforms...

Cloud Security

AWS has announced that server-side encryption (SSE-S3) is now enabled by default for all Simple Storage Service (S3) buckets.

Mobile & Wireless

As smartphone manufacturers are improving the ear speakers in their devices, it can become easier for malicious actors to leverage a particular side-channel for...

Cyberwarfare

The U.S. is tracking a suspected Chinese spy balloon spotted over U.S. airspace, officials said on Feb. 2, 2023.

Privacy

Many in the United States see TikTok, the highly popular video-sharing app owned by Beijing-based ByteDance, as a threat to national security.The following is...