‘Facebook email’ leads to Blackhole malware attack: Sophos

• Unsolicited email has some obvious clues that it is not genuine
• But always the danger that some users will be tricked into clicking on the link

FACEBOOK users are warned to be on their guard against unsolicited emails they might receive suggesting that someone has left an offensive comment about them on their wall.
 
The message reads as follows (click pic to enlarge):

In a statement, security specialist Sophos said that some users would hopefully have noticed that “whoever sent out the email has done a pretty poor job at disguising the message as though it were really from Facebook.”
 
The company noted that the ‘From: address,’ for instance, is ‘[email protected].’
 
“But there is always the danger that some computer users will be tricked into clicking on the link,” the company said.

And if you do make the mistake of clicking to find out more, you will not be taken to the real Facebook site, but instead your browser will visit a website hosting a malicious iFrame script detected by Sophos as Mal/Iframe-W.

Within seconds, your computer will find itself put at risk of malware infection via the notorious Blackhole exploit kit, Sophos said.

You may not notice, however, as the cybercriminals have redirected your web browser to a Facebook page which acts as a smokescreen to the attack (click pic to enlarge).
 
There is no suggestion that the owner of this Facebook page is in anyway related to the malware attack, Sophos said.
 
“Please remember to always be on your guard. You would have been protected from this threat if you had kept your wits about you,” the company added.
 
Even if you didn't notice that "Faceb00k" was spelt incorrectly, you could have seen by hovering your mouse over the link that it wasn't going to take you directly to the genuine Facebook website.
 
Said Graham Clulely, senior technology consultant at Sophos “Obviously, it's also very important to run up-to-date anti-virus software and keep your computers patched against the latest vulnerabilities.”
 
“If you don't take the right steps to protect your computer, one day a cybercriminal might find the right social engineering trick to dupe you into making a bad decision or visit a dangerous website,” he said.