Two top botnet gangs are bombarding Facebook members with targeted phishing emails. They’re hoping to get control of members’ Facebook and other accounts – a rising type of cybercrime.</p>
<p>There is nothing Facebook can do, beyond warning its members, to slow down these attacks. “This virus has been spreading over email, not on Facebook,” says Facebook spokesman Simon Axten. “Were educating users on how to detect this through the Facebook Security Page.”</p>
<p>In one of the ongoing attacks, the bad guys are directing an army of computers they’ve previously infected to systematically send out individual email messages to millions of Facebook members.</p>
<p>The messages advise recipients to click “here” to activate a “new login system that will affect all Facebook users.” This takes the victim to mocked-up Facebook log-in page with the victim’s email address already filled in, but the password is blank. Typing your password gives full access to your Facebook account to the crooks. </p>
<p>But the bad guys aren’t done yet.</p>
<p>Another prompt then appears, advising you to download an update tool, which actually installs the ZeuS banking Trojan. It lurks on your hard drive waiting for a chance to steal your online banking log-in information the next time you type it. </p>
<p>As of this morning, AppRiver had counted 41 different Web domains sending out 600 of these targeted phishing emails per minute. “We have seen around 6 million pieces of email so far this morning,” he says.</p>
<p>At its peak yesterday, about 1,000 viral emails per minute were being pushed out, he says. “This was a two-pronged attack,” says Touchette. “The first purpose was to phish Facebook accounts, and the second was to attempt to deliver a Trojan onto the victims machine.”</p>
<p>This same cybercrime group has tried variations of this attack with email lures purporting to come from the IRS, the British customs service and a banking consolidation service in the United Kingdom called One Account. The latest campaign was preceded by a similar one, with messages purporting to come from the FDIC. The crooks’ main goal is to “intercept financial account information,” says Tochette.</p>
<p>The other big, ongoing Facebook phishing campaign began on Monday around noon Pacific time, says Jamie Tomasello, abuse operations manager for messaging security firm Cloudmark.</p>
<p>These emails purport to come from <a href="mailto:support@facebook.com">support@facebook.com</a>, and contain a zip file said to hold the recipient’s new password, recently changed for security reasons by Facebook.</p>
<p>This simple ruse is fooling many. Cloudmark has found evidence of Facebook members actually going into their junk mail folders to retrieve these viral messages, then clicking on the infectious zip file. This installs a banking Trojan, called Bredolab, which competes against ZeuS for sales in the cyber underground.</p>
<p>Similar attacks are inundating Twitter, as well. So many Twitter users are changing their passwords to start anew that Twitter but can’t handle the changes and has begun locking out such changes. Twitters now advises users not to change their usernames and passwords.