SHARE
As we also reported about a browser extension malware which is hijacking online accounts, now Microsoft also got requests from user a Malicious browser extension similar to that hijacking Facebook profiles.

 

 
According to Microsoft they received many request from users about a Malicious browser extension which is trying to hijack Facebook profiles, this threat was first discovered in Brazil and Microsoft detected as Trojan:JS/Febipos.A, Microsoft’s technet blog report says. 

 
 


 
 
This Malicious Browser extension specially targeting Chrome and Mozilla. 

 
When installed, it attempts to update itself using the following URLs:   

  • Chrome browser:- du-pont.info/updates//BL-chromebrasil.crx  
  • Mozilla Firefox browser:- du-pont.info/updates//BL-mozillabrasil.xpi 
Note: Updated versions of this threat have been verified and are still detected as Trojan:JS/Febipos.A. 

 
To begin with, this Trojan monitors a user to see if they are currently logged-in to Facebook. It then attempts to get a configuration file from the website .info/sqlvarbr.php. The file includes a list of commands of what the browser extension will do. 

 
Depending on the file, this malware can do any of the following in the Facebook profile of an infected system: 

  • Like a page 
  • Share 
  • Post 
  • Join a group 
  • Invite friends to a group 
  • Chat to friends 
  • Comment on a post 
At the time of writing this blog, we also seen the following behavior.(Microsoft says) 

The configuration file contains a command to post the following message in Facebook: 

  • GAROTA DE 15 ANOS VÍTIMA DE BULLYING COMETE SUICÍDIO APÓS MOSTRAR OS SEIOS NO FACEBOOK
Vìdeo no link abaixo: 

It is written in Portuguese and here’s an English translation: 

  • 15 YEAR-OLD VICTIM OF BULLYING COMMITS SUICIDE AFTER SHOWING HER BREASTS ON FACEBOOK. 
Video on the link below: 

 
The above URL is unavailable and already blocked by Facebook. 

 
The number of “likes” for this page grew as we analyzed this malware. When we began analysis the page statistics looked like this: 

 
·         Facebook page likes: 2,746 

·         Facebook shared link likes: 167 

·         Number of comments: 165 

After several hours this had risen to: 

·         Facebook page likes: 3,177 

·         Facebook shared link likes: 201 

·         Number of comments: 183 

 
>>Catch all these Latest Updated More Easily<< 

Subscribe to our Newspaper 

Follow us on FacebookTwitter and Google+
 

NO COMMENTS

LEAVE A REPLY

This site uses Akismet to reduce spam. Learn how your comment data is processed.