Facebook Fail Friday: Koobface hits Facebook againPieter posted in "News". 6 years, 11 months ago
Today’s Facebook Fail Friday isn’t about something humorous for a change, because we’d like to pay attention to the recent resurgence of Koobface, the dreadful and persistent Facebook worm. Genuine fail, if you ask us.
This version of the infamous worm tries to lure its victims by promising a hidden camera video showing erotic encounters on a YouTube-like page with as title “Video posted by … Hidden Camera …”. A pop-up on this site will instruct the user to download a video codec in order to watch the video, but this executable is in fact the Koobface worm. If a user downloads and runs this file, his or her PC will become infected.
A notable feature of this particular attack is that the malicious download only works the first time the victim accesses the site. Subsequent attempts generate what looks like a 404 error (Page Not Found). Attackers do this to hamper the work of security researchers, so that it becomes more difficult to analyse subsequent differing versions of the malicious code.
So be very wary of the page shown in the above screenshot as well as similar looking pages. This layout is the trademark of all Koobface versions until now. And never download video codecs from sites other than that of the developers’ (eg. get Flash only from Adobe) and keep your antivirus software updated!