Fake Facebook Profile Viewer Installs Shady Web Browser Extensions

July 4th, 2013, 19:00 GMT · By Eduard Kovacs

Security researchers from ThreatTrack Security have come across another Facebook profile viewer scheme.
Experts have found a Tumblr blog, Candycrushsagafreelifes(dot)tumblr(dot)com, that’s designed to trick users into installing an app that can allegedly allow them to see who has been viewing their Facebook profile.

Users who follow the instructions on the screen and download the so-called profile viewer are served an executable file called “ProfileViewersSetup.exe.”

When launched, the executable appears to do nothing. However, a rogue web browser extension is installed onto the victim’s computer.

The interesting part about this attack is that the rogue extension is installed very quickly. If the victim uses Firefox and the browser is open when the executable is launched, the application closes and restarts.

Right after re-opening, a notification window appears on the screen. This notification is the one that usually appears when users install extensions.



However, this one stays on the screen only for around one second, so the user can’t uncheck the “Allow the installation” checkbox.

If Firefox is not open when ProfileViewersSetup.exe is executed, the browser is launched and the same notification appears for a second or so.

Full details here: http://news.softpedia.com/news/Fake...lls-Shady-Web-Browser-Extensions-365611.shtml