Indications have emerged that the emails purpotedly sent by Facebook to members to reset their passwords following identified threats on their accounts is in fact an attack.
According to Anti-Virus industry experts, the malicious executable is linked to the Bredolab botnet, which has been linked to massive spam runs and identity-theft related attacks.
The email uses fake Facebook password-reset messages to trick PC users into downloading a dangerous piece of malware. These dangerous malware allows the attackers have full control of your PC, such as steal customer information, send spam emails and practically do as they please.
Websense, an industry player says the address of the sender is spoofed to display “[email protected],” a trick commonly used to trick recipients into believing that the email is a legitimate email from the network.
The alert says,
“Websense® Security Labs™ ThreatSeeker™ Network has discovered a new wave of malicious email attacks claiming to be a password reset confirmation from Facebook. The From: address on the messages is spoofed using [email protected] to make the messages believable to recipients. The messages contain a .zip file attachment with an .exe file inside (SHA1:d01c02b331f47481a9ffd5e8ec28c96b7c67a8c6). The .exe file currently has a detection rate of about 30 percent on VirusTotal. Our ThreatSeeker™ Network has seen up to 90,000 of these messages sent out so far today”.
“The malicious .exe file connects to two servers to download additional malicious files and joins the Bredolab botnet which means the attackers have full control of the PC, such as steal customer information, send spam emails. One of the servers is in the Netherlands and the other one in Kazakhstan”.
A Screenshot of the fake alert is shown below.
- Fake Facebook reset password alert
All facebook account holders are hereby encouraged to disregard this email and take as much precaution as possible before downloading attachments that come with similar emails in the future if they are unsure or suspicious of the source.
The virus has a 30% detection rate on Virustotal. Virustotal is a service that analyzes suspicious files and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware detected by antivirus engines.
As at the time of writing this report, the Anti-virus programs that detected the malware are:
The following did not detect it according to the Virustotal analysis;
Please don’t join the bredolab botnet and help in spam reduction.
Be sure your Anti-virus program is up-to-date.