Facebook malware continuing its march

Facebook users are being pounded by “clickjacking” attacks that have been affecting the site at unusually heavy levels for weeks.

The BBC notes that popular topics like the World Cup and Hayley Williams are driving the attacks, with users now regularly seeing posts claiming to offer “Justin Bieber’s phone number,” which have allegedly been “liked” by their friends. When a user clicks on one of these posts, the “like” spreads further on the user’s own Facebook wall — even if the user never actually clicked the “like” button at all.

Right now these attacks are seen as relatively benign, since they only propagate these likes (and get more people to visit the Web page) but don’t damage your computer. That could change, though, experts note: All an attacker needs to do is code malicious content on the landing page of one of these likes, and the world could be in for a major security headache.

In fact, other attacks with malicious intent are spreading on the site. As BioScholar notes, three new phishing attacks hit over the weekend, with malicious code attempting to steal log-in and password information from users after they were duped into downloading a video on the site.

The most recent of these attacks attempts to get users to click on a “hilarious video” on the site, then requests Facebook log-in information so the video can be watched, installing malware along the way under the guise of adding a media player application to the PC. The login information is stolen, of course, and the user’s account is compromised from that point on unless the password is changed. And the malware “media player” installed on the PC stays behind even if the account information is altered.

The bottom line on Facebook security appears to be becoming more and more plain: Don’t click on anything.