Scammers are spamming a new e-mail that claims you were tagged in a photo added on the social network. The e-mail includes a link to a webpage that uses the Blackhole exploit kit to put malware onto your computer, before quietly redirecting you to a Facebook profile as if nothing was amiss.
Scammers are sending out e-mails saying that someone has added a photo of you and tagged you in it on Facebook. The spam comes with a link that tries to install malware on your computer.
Sophos, which first spotted the attack, detects the malware as "Troj/JSRedir-HW." The security firm provided the following sample e-mail (screenshot above):
Notice the e-mail address: "notification@faceb
oook.com." Facebook is intentionally misspelled as "Faceb
oook" with
three Os. If you click on the link in the e-mail, you are not taken to Facebook but to a website hosting a malicious iFrame script which takes advantage of the Blackhole exploit kit. To cover up what just happened, however, four seconds later your browser is taken via a META redirect to a Facebook profile of a presumably entirely innocent individual.
As a general word of caution, don't open attachments in e-mails or click on links in them unless you are absolutely certain that the sender is who you think you are.
