Messenger virus. A new threat for Facebook users. (January 2020)
Messenger virus is a term used to describe malicious messages that try to infect users' machines with malware via this messaging platform
Messenger virus is a cyber infection that can relate to data theft
Facebook Messenger virus is a computer infection that is caused by phishing messages sent from a hijacked Facebook account. In other words, the owner of the account had it compromised, which resulted in hackers taking over it and sending malicious spam messages to everybody in the victim's Facebook contact list – attachment spam is generated on a particular schedule (once or twice a day). As a result, the recipients tend to trust the message and click on the malicious link or download a booby-trapped file that executes the Messenger virus on the computer.
The so-called Facebook Messenger video virus usually delivers a link, e.g., play_74841038.mp4.com, video_12855.bz, or a shortened bit.ly link, as well as a short message designed to capture victims' attention: “Is that you?” or “XXX video.” The embedded icon often represents the YouTube logo, so users have even less suspicious when clicking the link.
Questions about Facebook Message virus
Messenger virus is one of many different versions of Facebook virus and can represent a wide variety of malware, including cryptominers,[1] data-stealers, trojans (such as FormBook trojan) and other infections. It has been around since 2013, as cybercriminals saw that the technique works particularly well due to the hijacked account component, as the issue is still prevalent nowadays, and Facebook Messenger Virus in 2019 hijacked accounts of thousands of users worldwide.
| Name | Facebook Messenger virus |
|---|---|
| Type | Facebook virus |
| Category | Malware; scam; spam |
| Active since | 2013 |
| Increased activity |
|
| Symptoms | Delivers questionable content, redirects, fake direct messages or notifications, malicious downloads, hyperlinks |
| Main danger | Infects the system with other malware, exposes to malicious content and steals sensitive information (login credentials, financial data, etc.) |
| Distribution | Messages with hyperlinks sent from compromised accounts |
| Avoidance tips |
Creating complex passwords that conclude from at least 12 alphanumeric characters. Avoid clicking hyperlinks in suspicious messages. |
| Removal | Facebook Messenger virus removal depends on what type of infection threat actors were trying to spread. Nevertheless, most of malware can be terminated with reputable anti-virus software like SpyHunter 5Combo Cleaner |
| Damage fix | Trojans and worms can infect computer system files, which anti-virus cannot remediate. As a result, Windows might start crashing or returning multiple errors after malware is removed. To fix virus damage, scan your machine with PC repair tool Reimage Reimage Cleaner |
Although Messenger virus has been doing the rounds of Facebook for years, it seems that it's on the rise again. Recently, the National Agency for Computer Security[2] and numerous other organizations[3] alerted Internet users about new cases of a Messenger virus and urged them to delete any suspicious messages immediately.
Main features you must know about Facebook Messenger virus
The latest Facebook Messenger virus contains the following details:
- a profile picture
- the name of the recipient
- an active link
- emoji
German cybersecurity experts[4] have expressed their concern over an active Facebook Messenger scam that is featuring video.bz link and the name of the potential victim, e.g. “[name of the recipient] Video :o”. Experts warn that this type of links can redirect to a site requiring to reconnect to Facebook. That's a catch to extort people's Facebook login details and, therefore, take over the account.
With the purpose to hack victims' Facebook accounts, hackers also attack people via messenger window. They display a fake popup message from an individual who seems to be the victim's friend and show a link to some website.[5] If you click on this link, you will likely get redirected to a fake copy of Youtube or some other site which will suggest installing a browser add-on or software in order to view the content. If the victim agrees, the PC gets infected with malware, which additionally blocks security software in order to prevent its elimination.
The virus can also start sending the fake message to the victim’s contacts via the same Facebook chat windows. Please, ignore all suspicious messages that come to your inbox. Even more, contact the sender and ask about the picture or video if the messenger sent an attachment spam to you.
Facebook Messenger virus is an infection that can affect the user's privacy and computer stability
In 2016, French[6] computer users were attacked by A Facebook Messenger Trojan named “Eko”[7] that can spy on users and collect personally identifiable information. The same year English-speaking computer users suffered from the wave of messenger spam spreading a video virus. There were two examples of messages asking: “You are in this video? ” and “This is your video? .”
In 2017 a variant of Locky ransomware had been distributed with the help of Messenger too.[8] Criminals send a message with a picture in SVG format. Once people clicked on it, they were redirected to a website that asked to install the fake Chrome extension.[9] Installation of this application leads to the infiltration of a dangerous file-encrypting virus.
Another thing, which is usually done by Facebook Messenger virus, is the continuous distribution of itself via the victim’s social media account. You may ask why scammers create such viruses. It has been revealed that the virus helps to steal personal information, such as logins, banking data, and passwords, and controls the machine.
Facebook Messenger virus continued the work of previous variants in 2017. Victims receive a fake YouTube link from their contacts.[10] Once a person clicks on it, the virus redirects to a fake website that looks identical to Facebook. Here people are asked to enter their login details. As a result victim’s account is taken over by the hackers and the malicious message is forwarded to the whole victim’s contact list.
Facebook Messenger virus is a scam that might convince users to enter infectious hyperlinks
However, if you clicked on a malicious link already, you should remove Facebook Message virus immediately and change your account’s password. If you cannot set a new password, you should report about hacked account Facebook via Support Centre. What is more, you should also change passwords of other accounts, especially if you use the same one.
For Facebook Message removal, we suggest using SpyHunter 5Combo Cleaner or Malwarebytes. Reimage Reimage Cleaner can be used further to find corrupted system components and eliminate all errors on the system.
April 10, 2018. Facebook Messenger virus emerges in a new form
The Facebook Messenger virus starts using the message made like that: “its you? (target's name) :|”. The deceptive messages contain a link to a video on a phishing web page. If the victim clicks on the link, s/he visits the malicious domain and then receives a notification asking to install “required software” to watch the video.
In case the victim fails to identify a scam and installs the suggested application or update, his computer gets entirely compromised, and the Facebook account gets hacked to send messages with the malicious video link to all of the victim's friends.
If you noticed Facebook Messenger video virus affecting one of your friends, do not ignore it! Let them know and suggest them to scan their computers to detect the malware. Also, consider advising them to post a message on their wall, asking people not to open the video. Spreading knowledge is the only way to put an end to Facebook scams and viruses that promote them.
New wave noticed on December 5, 2018
A new wave of the malicious virus was spotted on December 5, 2018. This time, the scammers are distributing shortened bit.ly link with a short note “[name of the recipient] Video.” Once clicked, the link redirects the victim to a Google Doc page, which contains a picture that was automatically taken from victim's social media page.
The picture looks like a movie, so the victim will likely click on the play button to start it. Sadly, the virus then redirects the victim to websites that determine the victim's browser type, geolocation, and other details.
Depending on the operating system, another redirect occurs. Experts report that Firefox users get redirected to a site offering fake Flash Player update, while Chrome users receive a prompt to install a malicious extension. People using Safari on Mac will receive a suggestion to install “the latest version of Media Player.”
After installing the malware, the user's account could get compromised and start sending the virus link to all friends automatically. However, it is yet unclear how exactly the virus spreads. The attackers might be using clickjacking attacks or spying software to steal victims' login details.
June 20, 2019. Security researchers report about new strings of the virus
Tunisian and German users are among the first ones to be alerted by authorities about a proliferation of Facebook Messenger virus. The report of National Agency for Computer Security has been publicized yesterday addressing Tunisian netizens to be careful with Facebook Messages sent from a friend, which contain your name and a link to YouTube-looking video.
At the same time, German cybersecurity team, along with dieviren.de experts, reported the same problem on the German users' Facebook accounts. People should beware of catchy looking messages on Facebook Messenger from a friend, which contain the name, emoji, and a supposed-to-be link to YouTube video.
Such fake messages are used by hackers to redirect people to phishing websites and trick them into giving away their Facebook login name and password or downloading malicious programs disguised under fake Java, Flash Player updates or other software.
The compromised accounts spread malware via Facebook Messenger
The virus can easily infect your computer with the help of infected message that shows up on person-to-person chat. Typically, it offers to see a “shocking picture” or “exciting video.” Many users of this social network have been tricked by this scheme because this message looks like it was sent by one of the victim’s contacts.
Once a person clicks on the infected link, the virus enters the system. What is more, the same message is usually spread further to the victim’s contact list and tricking other users. Therefore, it’s a chain reaction that is nearly impossible to stop.
We want to remind that the only way to protect your PC, Facebook account and personal details are not to click suspicious links sent from your friends, colleagues or family members. If you suspect that the content of the message seems suspicious, you should ask your friend if this link or file is safe to open.
Keep in mind that cybercriminals tend to reply to victims. However, if you know the person, it won’t be hard to identify that you are talking with a different person. Otherwise, you should ask yourself if a person you haven’t spoken in years actually wants to share a video or picture with you. Most likely not.
Remove Facebook Messenger virus and protect your privacy
Nevertheless, virus on Facebook seems like spam; you should still check your computer’s state. Scanning computer with an anti-malware program is especially recommended if you have clicked on a suspicious link or downloaded unknown content.
In order to remove Facebook Messenger virus, we suggest scanning the computer with SpyHunter 5Combo Cleaner or Malwarebytes. You can use Reimage Reimage Cleaner after the first removal stage to ensure that there is no virus damage left. However, you should not forget to update your preferred program.
Another important Facebook Messenger virus removal step is to change your password. If hackers took over your account, they might get credentials to email, bank, and other accounts. Thus, in order to protect your privacy, you should set a strong password. Keep in mind that good password:
- is at least 12 characters long;
- has numbers;
- has capital and lower-case letters;
- has symbols (if allowed);
- does not have your name, surname and other personal information included;
- is not a dictionary word.
About the author
If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.
References
- ^ Olivia Morelli. FacexWorm cryptocurrency mining virus spreads via Facebook Messenger. 2-spyware news and virus removal guides.
- ^ Tunisie : L’Ansi prévient contre un nouveau virus sur Facebook. Kapitalis. News site oriented to Tunisian PC users.
- ^ Video virus su Facebook, cosa non bisogna fare: qualche suggerimento. Ci siamo. Notizie d'Italia.
- ^ Vorsicht, neuer Virus verbreitet sich gerade über Facebook!. Brigitte. Breaking news for German-speaking community.
- ^ Cara McGoogan. Facebook Messenger scam steals passwords and hijacks accounts. The Telegraph. Latest news, business, sport, comment, lifestyle and culture.
- ^ LesVirus. LesVirus. French site about virus news, malware and removal instructions.
- ^ David Bisson. Eko Facebook Messenger Malware Targeting French Users via PM Scams. Tripwire. Advanced Threat Protection & File Integrity Monitoring.
- ^ Facebook users hit with “You are in this video?” malware scam. HackRead. InfoSec, Cyber Crime, Privacy, Surveillance, and Hacking News .
- ^ David Jacoby. New multi platform malware/adware spreading via Facebook Messenger. Securelist. Information about Viruses, Hackers and Spam.
- ^ Brett M. Christensen. Beware of Scam “YouTube Video” Facebook Messages. Hoax-Slayer. Website that helps to make the Internet a safer, more pleasant and more productive environment.
May 2nd, 2015 at 12:28 am
ik heb virus op mijn Facebook ben er hal 9 uur mee aan de gang en wat ik ook doe de virus komen terug maar mijn vrienden niet kwijt nu 678
February 21st, 2016 at 8:27 am
I want to remove sms in shakeel buneri account
September 28th, 2016 at 1:57 pm
kkkkkkkkkk
September 28th, 2016 at 1:58 pm
vbgkjgtgfeyfjtyerg