An Internet security firm has warned online users, particularly from the Philippines, of another scam campaign on Facebook that spreads a malicious browser plug-in via social engineering techniques.
By the start of April 2016, e-security firm ESET said it had detected the threat more than 10,000 times in dozens of countries around the world. Currently, more than 2,600 people within Asia Pacific have been affected. The highest incidence of this scam was found in the Philippines where 1,803 people have fallen victim to the scam.
The attack starts by luring Facebook users into playing a video, most often titled “My first video”, “My video” or “Private video”.
After clicking on the video link, the victims is directed to a fake YouTube website where he/she is requested to install an additional extension before the video can be played.
The extension is a malicious version of the otherwise legitimate “Make a GIF” plug-in. ESET detects this threat as JS/Kilim.SO and JS/Kilim.RG and users of ESET security products are protected from it.
If the victim installs the malicious plug-in, his/her browser becomes infected and carries the infiltration further to his/her Facebook timeline, which becomes flooded with fake video posts tagging multiple friends from their friends list.
Subsequently, all their online friends will receive an identical message via Messenger with the same harmful video link.
“The malicious campaign is spreading spam messages and infecting Facebook accounts with a very high rate of success. At this point, the infiltration only targets Chrome users, but there is no guarantee that it will not spread to other browsers in the future. This scam also has potential to become more dangerous in the future, spreading other, more powerful malware with new capabilities,” commented Lukas Stefanko, ESET malware researcher.
ESET’s recommendations for victims of this scam include:
1. Immediately remove the malicious “Make a GIF” extension from your Chrome browser.
Either type “chrome://extensions/” into the address bar or go to Customize and control Google Chrome -> More tools -> Extensions -> Make a GIF -> Remove from Chrome. If you also use the legitimate “Make a GIF” extension, use the pictures below to distinguish the original version from the infected one.
If you click on Details -> View in store, you will see details about extension.
2. Scan your computer with a reliable antivirus software.
