Malware spreading via Facebook has become a rare occurrence, but it does still occasionally crop up.
The latest instance has been noticed by malware researcher Bart Blaze, and takes the form of image files (.svg files, to be exact) that are being automatically sent from compromised user accounts:
The plugin in question (for Google Chrome) can change users’ data on the websites they visit, i.e. it’s the tool that sends out the message with the SVG file to other users.
Whether it is also capable of downloading other malware is currently unclear, but eCrime specialist Peter Kruse says that the SVG file does not always redirect users to the malicious Chrome extension.
His research showed that, in other instances, the file contains the Nemucod downloader, which ultimately downloads the Locky ransomware on the victims’ machine.
How the SVG files managed to bypass Facebook’s file whitelist is also unknown, but Facebook has been notified of the attack, and will hopefully soon block it entirely. Google has already removed the offending extensions from its Chrome Store.
If you’ve been tricked into installing the extension, remove it by going to Menu > More Tools > Extensions. After that, check your computer for additional malware. If you’ve been unlucky and you’ve ended up with Locky, an up-to-date backup is your best bet for restoring your files.
“As always, be wary when someone sends you just an ‘image’ – especially when it is not how he or she would usually behave,” Blaze advises.
UPDATE: Blaze tells us that the SVG file he analyzed and which pushes users to the fake YouTube video also contains the Nemucod downloader, but hasn’t witnessed it downloading Locky.