The spam is spawning from a spambot named Asprox. This is the gang behind a lot of the bogus emails purportedly sent to victims from DHL, FedEx, UPS, USPS spam.
If you get a pop up screen from "Facebook Support" it looks legitimate and the message makes you think that Facebook is really on the ball protecting you.
Facebook Service is notifying you that since spam was sent from your account, they changed your password for your "safety" and they ask you to open the zip file attachment for more information.
Here's your red flag - Facebook will not send you a note asking you to download a zip file for more information.
If you do download the file it has the Sasfis trojan in it which connects to domain name pupmypzed.ru.
Source:
M86 Security Labs Blog - research and the screen shot
No comments:
Post a Comment