Trusteer researchers released the details of a sophisticated new malware attack targeting Facebook users. The goal of the Ice IX malware scheme is to steal credit card information and personal account information. This is accomplished by using a web injection cycle to display a malicious web page in the victim’s browser.

The form tries to obtain cardholder name, credit card number, expiration date, CID and billing address. Users are advised this form must be completed to verify their identity and to further secure their Facebook account. Once a user falls for the scheme, the form data is delivered to the malware authors using an instant messaging script. This is especially dangerous since it allows for immediate account access.

Check out their blog post to see an example of the rogue form in action and to see a walkthrough of a marketing video discovered in underground forums. The scammers use this video to showcase how web injection attacks are perpetrated. According to Amit Klein, the video:

1. “illustrates the seamless sophistication of pre-built webinjects that are readily available for purchase on the Internet.”
2. demonstrates sophisticated marketing techniques used by cyber criminals in marketing malware delivery products.
3. highlights how scammers are moving away from online banking schemes to target the large pool of social networking users.

Trusteer contacted Facebook regarding the attack and Facebook requested they pass on the following information:

1. Facebook actively detects known malware on users’ devices to provide Facebook users with a self-remediation procedure including the Scan-And-Repair malware scan. To self-enroll in this check point please visit – on.fb.me/AVCheckpoint
2. Please advise your readers to report to Facebook any spam they find on the Facebook site, and remember Facebook will never ask for your credit card, social security, or any other sensitive information other than your username and password while logging in.

Recommended Resources

BitDefender Safego is a Facebook application you can install that will scan your News Feed and help keep you safe from scams like this.

PRIVATE WiFi® is a Personal VPN that encrypts everything you send and receive. Don’t access Facebook from a public WiFi hotspot without it.

Do Not Track + is a FREE browser plugin created by Abine. This easy to install plugin keeps websites from tracking you. If you value your online privacy, then you should definitely take advantage of this free product.