In a rather ironic twist of events, hackers are impersonating the Facebook Security Team on the social network. Their modus operandi is simple, ingenious, and one we have warned about several times in the past.

They start out by hijacking an account. Next, they change the name on the account to “Facebook Security”. Normally, Facebook has an algorithm that forbids the use of such words on a person’s name and it usually takes 24 hours for the name change itself. But the hacker uses special Unicode characters that spell “Facebook Security”. Also, according to Kapersky Labs expert David Jacoby, the name change occurs instantly. The Unicode characters used causes the letters to have little squiggles – which should clue you in on the fake nature of the message. The hacker also changes the person’s profile picture to the Facebook Security logo. Once these changes are complete, they send a chat message to people on the hijacked account friends list and inform them that unless they “reconfirm their information”, their accounts will get suspended.

The message reads:

“Last Warning: Your Facebook account will be turned off because someone has reported you. Please do re-confirm your account security by: (link)”

The link leads them to a fake page that looks similar to Facebook, only it’s hosted on an external domain. There, users are told to enter their name, email, password, their security questions, and other personal details. Once users enter this data, they will be directed to another form that asks for credit card information.

The attack has reportedly becoming more and more widespread. Users are warned to be wary whenever they’re personally contacted by “Facebook Security”. Always check the URL and make sure that you’re still on Facebook. More importantly, do not give out your credit card details or your password. Facebook will not ever ask for them. Also, since this attack mostly comes from hijacked accounts on your friend list, be sure to warn your friends of this phishing attack so that they won’t fall victim to it easily. Remember, your network’s security is only as strong as its weakest link, so to speak. If one of your friends fall victim to the attack, the next target would most probably be you and your other mutual friends. You should unfriend or block the offending account until it is reclaimed.

Also, in case you’ve already fallen victim to this attack, it’s recommended that you report the matter at once to Facebook and immediately change your password. If you provided the hacker your credit card information, then you also need to contact your financial institution to have the card cancelled as soon as possible.