A common browser-based malware attack often targeted at online banking sites has now been configured to attempt and phish credit card details from users logging in to their Facebook accounts.
Unsuspecting Facebook users exposed to the malware will receive a pop-up window purporting to be from Facebook when they attempt to login. The pop-up claims that information is needed to verify the user’s identity and provide additional security while asking for the user’s credit or debit card number, name, billing address, card expiration date and CVV number. If provided, this information is sent directly to the fraudsters who now have enough information to use this credit or debit card fraudulently online.
This particular malware is a variant of Ice IX which, similar to Zeus and other strands of malware, is most known for similar browser-based attacks targeted at online banking users. However, fraudsters are now expanding their reach as they modify such malware to attack a broader audience: the millions of social networking site users.
While most everyone in the fraud and e-payments industries knows better than to provide full credit card details as a means of verification at login, and especially at a site where most users have no intention of making a purchase, we must keep in mind that the general public is not as well-informed. The fact that such malware tactics are effective underscores the need for greater consumer education with respect to personal security and best practices when going online. Facebook released a statement saying they would never ask for credit card details, Social Security numbers or other sensitive information to verify users logging in, but consumers will continue to be duped by such malware regardless.
For more information: