Messenger virus. A new threat for Facebook users. (May 2019)
Facebook Messenger virus — a malicious strategy used to infect devices via Facebook attachment spam
Messenger virus is a cyber infection that can relate to data theft
Questions about Facebook Message virus
Facebook Messenger virus is a term used by users and security experts to describe a technique seeking to hijack the targeted Facebook account and send malicious links on behalf of the account's user. An attachment spam is generated on a particular schedule (once or twice a day) and distributed to all of the victim's friends automatically. The infected Facebook Message delivers a shortened link, e.g. video.bz or video_12345.bz, and an intriguing phrase including the name of the recipient and a couple of emojis. The embedded link seems to be leading to a YouTube or video link. Once clicked, the malicious URL redirects to a phishing website filled with installers of the dangerous browser extension, fake Flash Player Updates, and similar content. The malicious virus works as a Trojan horse and belongs to the wide group of the Facebook virus. The virus has been active since 2013 and updated several times since then because of the increased activity.
| Name | Facebook Messenger virus |
|---|---|
| Type | Facebook virus |
| Category | Malware; scam; spam |
| Active since | 2013 |
| Increased activity |
|
| Symptoms | Delivers questionable content, redirects, fake direct messages or notifications, malicious downloads, hyperlinks |
| Main danger | Infects the system with other malware, exposes to malicious content and can steal private information |
| Distribution | Messages with hyperlinks sent from compromised accounts |
| Avoidance tips |
Creating complex passwords with at least 12 characters, letters, and numbers. Avoid clicking on suspicious hyperlinks from questionable messages. |
| Removal | Clean the system and remove Facebook Messenger virus using Reimage. |
Although Messenger virus has been doing the rounds of Facebook for month and years, it seems that it's on the rise again. Recently, the National Agency for Computer Security[1] has alerted Tunisian Internet users against the new wave of a Facebook virus and urged them to delete any suspicious messages immediately.
The latest variant is spread via Facebook Messenger and contains the following details:
- a profile picture
- the name of the recipient
- an active link
- emoji
German cybersecurity experts[2] have expressed their concern over an active Facebook Messenger scam that is featuring video.bz link and the name of the potential victim, e.g. “[name of the recipient] Video :o”. Experts warn that this type of links can redirect to a site requiring to reconnect to Facebook. That's a catch to extort people's Facebook login details and, therefore, take over the account.
With the purpose to hack victims' Facebook accounts, hackers also attack people via messenger window. They display a fake popup message from an individual who seems to be the victim's friend and show a link to some website.[3] If you click on this link, you will likely get redirected to a fake copy of Youtube or some other site which will suggest installing a browser add-on or software in order to view the content. If the victim agrees, the PC gets infected with malware, which additionally blocks security software in order to prevent its elimination.
The virus can also start sending the fake message to the victim’s contacts via the same Facebook chat windows. Please, ignore all suspicious messages that come to your inbox. Even more, contact the sender and ask about the picture or video if the messenger sent an attachment spam to you.
In 2016, French[4] computer users were attacked by A Facebook Messenger Trojan named “Eko”[5] that can spy on users and collect personally identifiable information. The same year English-speaking computer users suffered from the wave of messenger spam spreading a video virus. There were two examples of messages asking: “You are in this video? ” and “This is your video? .”
In 2017 a variant of Locky ransomware had been distributed with the help of Messenger too.[6] Criminals send a message with a picture in SVG format. Once people clicked on it, they were redirected to a website that asked to install fake Chrome extension. Installation of this application leads to infiltration of a dangerous file-encrypting virus.
Another thing, which is usually done by Facebook Messenger virus, is the continuous distribution of itself via victim’s social media account. You may ask why scammers create such viruses. It has been revealed that the virus helps to steal personal information, such as logins, banking data, and passwords, and controls the machine.
Facebook Messenger virus continued the work of previous variants in 2017. Victims receive a fake YouTube link from their contacts.[7] Once a person clicks on it, the virus redirects to a fake website that looks identical to Facebook. Here people are asked to enter their login details. As a result victim’s account is taken over by the hackers and the malicious message is forwarded to the whole victim’s contact list.
Facebook Messenger virus is a scam that might convince users to enter infectious hyperlinks
However, if you clicked on a malicious link already, you should remove Facebook Message virus immediately and change your account’s password. If you cannot set a new password, you should report about hacked account Facebook via Support Centre. What is more, you should also change passwords of other accounts, especially if you use the same one.
For Facebook Message remover we suggest using Reimage. This anti-malware will find all malicious components on the system and eliminates all possible threats entirely from the machine.
Updated on October 27, 2017. Facebook Messenger video virus emerges in a new form, and this time it delivers “its you? (target's name) :|” and similar messages. The deceptive messages contain a link to a video on a phishing web page. If the victim clicks on the link, s/he visits the malicious domain and then receives a notification asking to install “required software” to watch the video.
In case the victim fails to identify a scam and installs the suggested application or update, his computer gets entirely compromised, and the Facebook account gets hacked to send messages with the malicious video link to all of the victim's friends.
If you noticed Facebook Messenger video virus affecting one of your friends, do not ignore it! Let them know and suggest them to scan their computers to detect the malware. Also, consider advising them to post a message on their wall, asking people not to open the video. Spreading the knowledge is the only way to put an end to Facebook scams and viruses that promote them.
Updated on August 25, 2017. A new wave of the malicious virus was spotted. This time, the scammers are distributing shortened bit.ly link with a short note “[name of the recipient] Video.” Once clicked, the link redirects the victim to a Google Doc page, which contains a picture that was automatically taken from victim's social media page.
The picture looks like a movie, so the victim will likely click on the play button to start it. Sadly, the virus then redirects the victim to websites that determine the victim's browser type, geolocation, and other details.
Depending on the operating system, another redirect occurs. Kaspersky reports[8] that Firefox users get redirected to a site offering fake Flash Player update, while Chrome users receive a prompt to install a malicious extension. People using Safari on Mac will receive a suggestion to install “the latest version of Media Player.”
After installing the malware, user's account could get compromised and start sending the virus link to all friends automatically. However, it is yet unclear how exactly the virus spreads. The attackers might be using clickjacking attacks or spying software to steal victims' login details.
Updated on April 10, 2018. New strings of the virus have been noticed. Tunisian and German users are among the first ones to be alerted by authorities about a proliferation of Facebook Messenger virus.
The report of National Agency for Computer Security has been publicized yesterday addressing Tunisian netizens to be careful with Facebook Messages sent from a friend, which contain your name and a link to YouTube-looking video.
Messenger virus is a malicious strategy that can trick you into installing malware
At the same time, German cybersecurity team, along with dieviren.de experts, reported the same problem on the German users' Facebook accounts. People should beware of catchy looking messages on Facebook Messenger from a friend, which contain the name, emoji, and a supposed-to-be link to YouTube video.
Such fake messages are used by hackers to redirect people to phishing websites and trick them into giving away their Facebook login name and password or downloading malicious programs disguised under fake Java, Flash Player updates or other software.
The compromised accounts promote malware via Facebook Messenger
The virus can easily infect your computer with the help of infected message that shows up on person-to-person chat. Typically, it offers to see a “shocking picture” or “exciting video.” Many users of this social network have been tricked by this scheme because this message looks like it was sent by one of the victim’s contacts.
Once a person clicks on the infected link, the virus enters the system. What is more, the same message is usually spread further to the victim’s contact list and tricking other users. Therefore, it’s a chain reaction that is nearly impossible to stop.
We want to remind that the only way to protect your PC, Facebook account and personal details are not to click suspicious links sent from your friends, colleagues or family members. If you suspect that the content of the message seems suspicious, you should ask your friend if this link or file is safe to open.
Keep in mind that cybercriminals tend to reply to victims. However, if you know the person, it won’t be hard to identify that you are talking with a different person. Otherwise, you should ask yourself if a person you haven’t spoken in years actually wants to share a video or picture with you. Most likely not.
Remove Facebook Messenger virus and protect your privacy
Nevertheless, virus on Facebook seems like spam; you should still check your computer’s state. Scanning computer with an anti-malware program is especially recommended if you have clicked on a suspicious link or downloaded unknown content.
In order to remove Facebook Message virus, we suggest scanning the computer with Reimage, Malwarebytes MalwarebytesCombo Cleaner or Plumbytes Anti-MalwareMalwarebytes Malwarebytes. You can use other security software. However, you should not forget to update your preferred program.
Another important Facebook Messenger virus removal step is to change your password. If hackers took over your account, they might get credentials to email, bank, and other accounts. Thus, in order to protect your privacy, you should set a strong password. Keep in mind that good password:
- is at least 12 characters long;
- has numbers;
- has capital and lower-case letters;
- has symbols (if allowed);
- does not have your name, surname and other personal information included;
- is not a dictionary word.
About the author
If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.
References
- ^ Tunisie : L’Ansi prévient contre un nouveau virus sur Facebook. Kapitalis. News site oriented to Tunisian PC users.
- ^ Vorsicht, neuer Virus verbreitet sich gerade über Facebook!. Brigitte. Breaking news for German-speaking community.
- ^ Cara McGoogan. Facebook Messenger scam steals passwords and hijacks accounts. The Telegraph. Latest news, business, sport, comment, lifestyle and culture.
- ^ LesVirus. LesVirus. French site about virus news, malware and removal instructions.
- ^ David Bisson. Eko Facebook Messenger Malware Targeting French Users via PM Scams. Tripwire. Advanced Threat Protection & File Integrity Monitoring.
- ^ Facebook users hit with “You are in this video?” malware scam. HackRead. InfoSec, Cyber Crime, Privacy, Surveillance, and Hacking News .
- ^ Brett M. Christensen. Beware of Scam “YouTube Video” Facebook Messages. Hoax-Slayer. Website that helps to make the Internet a safer, more pleasant and more productive environment.
- ^ David Jacoby. New multi platform malware/adware spreading via Facebook Messenger. Securelist. Information about Viruses, Hackers and Spam.