A new Facebook spam of a malicious link connected with request.blob.core.windows.net has been spreading vigorously via users. Security researchers believe that the scam itself is redistributed by malicious software affecting primarily android devices, because after clicking on the questionable spam link, the user receives redirect to a web page prompting to ‘update’ Android. Security researchres strongly advise users to back up their phone contacts and other information on external devices after which use the manuals below to factory reset their android devices. It is also advisable to change all of your passwords, especially the Facebook password.
|Name||My Secret Video Facebook Spam|
|Type||Malicious Redirect/Malicious script/Spam Bot|
|Short Description||Redirect to a fake upgrade of Android, flash player or java.|
|Symptoms||After installing the malicious application the user may see posts on his Facebook profile without his consent.|
|Distribution Method||Clicking on malicious links distributed via spam in the friend list of the user under the title ‘Check my secret video|
|Detection Tool|| See If Your System Has Been Affected by malware |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss My Secret Video Facebook Spam.|
|Data Recovery Tool||Windows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.|
My Secret Video Facebook Spam – How Did I Get It?
One way you may have started seeing posts that you haven’t made featuring the hxxps://request(.)blob.core(.)windows(.)net/h172/1se
web link embedded in them is by clicking on the link itself. By default if you click on the link it may react differently for every OS. We have visited it from an android device and after 5 redirects we were redirected to the following page:
The web page displays a fake android upgrade prompt which some users may install. In reality, virus researchers are convinced that this is a malicious application which obtains permissions to many different key processes that manage the applications, the phone itself and the information in its memory. Once installed, the ‘upgrade’ may initiate scripts that give it permission to automatically post on your behalf.
My Secret Video Facebook Spam – More about It
Once installed on your device the Android ‘Upgrade’ may request and obtain read and write permissions as well as permissions to manage the installed applications of the device. The software then displays the following post:
The post itself tags the maximum number of no more than 50 users in the friend list of the profile it posts from. This is done along with the web link being repeated several times. When opened the web link starts bouncing from URL to URL and after 5 redirects it transfers the user to ms.offer-wonder.info – the site offering the ‘upgrade’.
Even though it is not confirmed, this particular phone malware may also interact with the device`s SIM card, in a malicious way. It may charge the user a lot of money for automatic messaging service without the user`s consent.
My Secret Video Facebook Spam – What to do If I Am Infected
In case you have install this application a simple uninstall from your app manager wont cut it. You should extract all your important data from your phone on a memory stick, upload it in the cloud, back it up or copy it to your computer. Copying the data to your computer by connecting to it is not advisable since the malware may download malicious files that infect PCs and influence it in this way. The truth is it really depends but you shouldn`t risk connecting your phone to the computer before securing it. In case you do not have any other option, we recommend to install external firewall on your PC such as ZoneAlarm. If you are with a mobile device, it is best to follow the instructions here.