Kaspersky Lab cautions about malware-laden Chrome extensions, that are being uploaded and hosted on Google’s Chrome Web Store.

The malware in question is  pretends to be a Flash Player installer but instead downloads a Trojan. Once installed, it takes control of a user’s Facebook profile and starts posting messages encouraging the victim’s friends to install the same extension. It also starts to automatically Like certain pages.

This, according to Fabio Assolini, is part of a pay-per-Like scheme that helps the attackers to cash in.

The attacks starts off as suggestions to download Facebook apps. The suggestions comes with messages saying your friends have also downloaded the same app.

This extension and its variants were found to be largely confined to Brazil and other Portuguese-speaking nations.

This trick is neither new nor specific to Chrome browser. However, it is easier for users to fall for it since the extension is distributed from trusted place like  the official Chrome Web store.

The extension was notified to Google and was duly removed. But, new variations of the extensions are being reportedly uploaded by the scammers on a regular basis.

So, users will have to use their best judgement and stay informed in order to stay safe from the millions of scams on the Internet that are doing the rounds.

Remember this for future reference. Adobe Flash Player is a plug-in and not an extension, and it is installed outside the browser.

Do you know you can change the color of your Facebook from its traditional blue to pink?

Well, this is what you might have or will come across on your feeds/network on Facebook. But, you can’t, so don’t fall for it.

Unfortunately, it looks like a lot of users are falling for it, and the scam is spreading fast on Facebook with post such as:

AWESOME!!!

HELLO PINK FACEBOOK!!! and Goodbye BLUE FACEBook!

Switch Your Facebook to 5 Different colors and themes here:

[LINK]

This is just another clever gimmick from scammers to coerce users into installing the app. Once installed, the app will be able to access the user’s account and spread the scam further by posting messages to lure you friends on your network.

As with most scam apps, users are taken through a series of steps and ultimately land them at an online survey page through which the scammers earn commission.

If you have already installed or given permission to the app, take some time to revoke the permission given to the app and remove any reference the app from your Timeline.

Facebook team up with the Washington’s attorney general have filed separate suits against Adscent Media, an ad network accused of encouraging the spread of spam via tactics like clickjacking.

In most Facebook scams, users are offered links to provocative content, and through a series of cleverly designed steps, tricked them into liking pages, and/or unwittingly surrendering personal information, subscribing to expensive services, and spreading links to their friends.

Likejacking is a form of clickjacking, which takes advantage of a browser vulnerability that permits malicious actors to make the ‘Like’ button invisible. Once the ‘Like button is made invisible, scammers can overlay pictures and other content, and trick users to click on the invisible ‘Like’ button.

In some cases, a process called “clickjacking,” codes are hidden in enticing-looking links, that activates Facebook’s ‘Like’ function.
Facebook said a browser vulnerability that allowed the exploit has been fixed so users shouldn’t continue to see the scam.

Adscend Media LLC, a self-described “performance-based marketing network”, is believed to have generated $20 million a year from the actions.

“We don’t ‘like’ schemes that illegally trick Facebook users into giving up personal information or paying for unwanted subscription services through spam,” Attorney General Rob McKenna said in a statement.

“Security is an arms race, and that’s why Facebook is committed to constantly improving our consumer safeguards while purshing and supporting civil and criminal consequences for bad actors,” said Facebook General Counsel Ted Ullyot.

A scam offering “Free Mobile Recharge” is currently targeting Facebook users.

According to McAfee, the victims are lured with messages that seems like they were posted by their friends claiming that they have received a “100rs free recharge”. On following the offered link, users are asked to enter their Facebook login credentials.

Once the user log in with their Facebook account, they are redirected to a page mimicking a Facebook one, which asks the user to complete a survey in order to unlock the recharge option. In the meantime, the page send the recorded login credentials – in clear text via a HTTP POST request – to a remote server operated by the scammers.

The scammers then use the login credentials of the victim to access his/her Facebook account, change information including password and email, and post the same message that lured the victim.

Umesh Wanve pointed out that the victims were not only endangering users in their network, but are also unable to do anything about it because even if they try to reset their passwords, they will not receive the password reset email from Facebook as email associated with their account is changed.

He further advised users to be careful when they find offers that sound too good to be true.

Dozens of rogue apps and scams appear on Facebook every month, and while thousands of careless/impulsive users fall prey to such scams, I believe majority of the users are using their better judgement when it comes to suspicious apps. So, now it looks like scammers are turning towards  Facebook games lately.

A woman from Greene County, PA, USA, was recently scammed though the popular Facebook game FarmVille.

According to a news report, the woman received an instant message from someone she friended while playing the game asking her to check out a link.

She clicked on the link and over the next two days, she noticed that two $400 withdrawals were made from her Facebook account.

She tried to contact her FarmVille fried about the scam only to receive an email response that said, “I am from Indonesia. I don’t speak English.”

She didn’t received any response from Facebook regarding the incident. FarmVille developer, Zynga said the incident would be investigated.

Watch out for similar foul play even when you are just gaming on Facebook, and if possible, using gaming cards rather than your credit or debit card to recharge your game credits will be safer.

In their latest, innovative attempt to generate income from unsuspecting Facebook users scammers have started using Facebook events, and millions of Facebook users are being invited to the bogus events.

According to Graham Cluley, senior technology consultant at IT security firm Sophos, an event called “Who blocked you from his friend list ?” has already tricked over 165,000 people into signing up, while more than 10 million users are left contemplating.

The “More info” section of the event’s summary instructions with links that leads curious Facebookers into visiting web pages with online surveys and competitions that earn the scammers commissions behind the scene.

So, apart from watching out for rogue apps, you can now add events to your vigilance list.

Malware and rogue apps on Facebook are abundant, and now-a-days most of them are spread through Facebook Chat.

The latest one which is being spreading rampantly comes with the following message:

“Father Crashes and dies because of THIS message posted on his daughters profile Wall! [Link]”

Following the link will take users to anti-spam verification test, then to take a mobile IQ challenge quiz.

Once the quiz is complete, the victim is asked to send an SMS to a number in their own country for results. The average price for the SMS reportedly cost around 3 EUR.

Stefan Tanase, Kaspersky Lab Expert, says the attackers are using IP goe-location and automatic translation services to perfectly tailor the app to ensure maximum efficiency rate by making sure they use the same language as their potential victim.

The app apparently comes with random names. It will access users’ basic info and Facebook chat, and sends the same message to online friends on the users’ list.

Users from about 65 countries are reportedly affected. Ukraine is worst affected by this malware where around 24.22% of the total affected user base has been target till date, followed by India (16.22%) and the USA (13.03%)became victims of this malware respectively.

So, watch out for it.

Most Rogue applications lure Facebook users with ability to see who checks out their profile or trick them into installing rogue apps to watch certain videos. Such apps appear on an almost weekly basis.

These fake applications trick users into taking surveys through which the app developer earn money.

Such applications doesn’t last long, but still manage to lure a few thousands before they get banned, just to resurface again with a slight variation.

Sometimes, one wonders whether these developers ever get tired. The bad news is, there are now toolkits costing around $25 for creating malicious Facebook apps. According to security firm Websense, using pre-defined templates and following simple instructions accompanying the toolkit, it’s a breeze to create viral scam apps.

With tools available at such low prices, there will be no end of rogue apps on Facebook. In fact, we will be seeing them more frequently now. So, watch out.

The latest Facebook scam doing the rounds is My Total Facebook Views that promises to show users how many people have looked at their profile, and redirects them to typical survey scam.

Updates from the app on the user wall read:

“My total facebook views are: [random number]. Find out your total profile views on: [Link]

By now I am sure most of you are wary about such apps. However, there will always be people who are impulsive or ignorant about such apps and spread them within your network.

So, stay alert and spread the news.

Police warned about a Facebook scam involving fake modelling agencies that appear to be Leicester-based.

According to a report on Press Association UK, apparently a number of false Facebook profiles has  been set up posing as modelling agencies with agency logos to appear genuine. The scam is likely using a number of social networking sites too.

The agencies contact children via email asking if they are interested in modelling, and after a series of communication, coercer or pressure the children into sending photographers of themselves in their underwear.

Police are investigating reports and are also said to be working with Facebook to remove them.

However, it is like for the scammers to set up new profiles, so parents and children should remain alert regarding such scams.