Facebook has been hit very hard the last few weeks with a never ending onslaught of new scams trying to trick innocent Facebook users. The latest one spreads with the message “I can’t believe a GIRL did this because of Justin Bieber” and links you to a YouTube look-a-like site called FouTube.

Fortunately Sophos customers are protected from being likejacked when using our browser helper object in Internet Explorer. The hidden iFrame is detected as Troj/Iframe-ET. This style of attack is quite old and resembles some of the first likejacking attacks we started seeing earlier this year.

Most Facebook attacks I have looked at recently were rogue Facebook Applications rather than simply liking a web page. This one is quite poorly crafted, yet it is still spreading quite quickly amongst Facebook users who can’t seem to get enough Justin Bieber.

One interesting thing while came up though, the person behind this attack displays an offer to purchase Facebook Groups/Fan pages, apparently to help further spread their malicious scams.

Like most scams this one does not appear to be spreading malware, rather just displaying survey scams and other tricks to get you to subscribe to premium rate SMS services on your mobile phone.

It’s unfortunate that almost eight months after likejacking started becoming common that Facebook has chosen to keep the simplicity of the “Like” feature and not implement a confirmation option that would alert a user who is logged into Facebook that they are endorsing another scam.

If you have accidentally “Liked” this web page you can remove it by visiting your Facebook Wall and choosing to remove your like. As a precaution against likejacking you may wish to logout from Facebook when you are not actively using it. These attacks do not work if you are not currently logged into Facebook.

If you’re a Facebook user and want to keep up on the latest threats and security news why don’t you join the Sophos Facebook page?

– Naked Security – Sophos on Naked Security – Sophos

• Facebook comment-jacking? OMG! I Can’t believe JUSTIN Bieber did THIS to a girl
  It's starting to seem like Facebook can't win against those who wish to use their service to scam, spam and simply cause trouble. Over the last day or so, a new type of attack has been spreading using...
• Miley Cyrus, Justin Bieber Facebook Spam Reemerges
  Recently we reported about a scam that targeted Facebook users which turned users who are curious about stalkers into unwilling spammers. Now we are seeing newly created domains that are related to ye...
• Beware the Justin Bieber erection Facebook scam
  That's possibly the most unlikely headline I've ever had to write in my computer security career, but never mind.. My guess is that regular readers of the Naked Security site might not be ardent fans...
• LizaMoon the Latest SQL-Injection Attack
  Working in the security industry brings about a myriad of challenges. This is especially true for vendors. We must do our best to educate and inform. At the same time, we want to avoid laying on the F...
• “Japan Earthquake Relief” and “Young girl commits suicide” Facebook apps
  Below we have a rather fetching page located at helpjapan(dot)co(dot)tv: Click to Enlarge "Japan Earthquake Relief: Help raise money for disaster relief in Japan with a few clicks of your mouse". ...
• If you forward this email…
  Posted by Carlos Arias, March 2011 It is not unusual to receive alarming emails warning that your email service will shortly be shut down or your favorite social networking site will no longer be free...
• More Likejacking: This Guy Took A Picture Of His Face Everyday For 8 Years
  Since posting about the Justin Bieber likejacking campaign, we have observed similar campaigns cropping up. Apparently, This Guy Took A Picture Of His Face Every Day For 8 Years Most recent and notabl...
• Free tickets on Southwest Airlines? It’s the latest Facebook scam
  Facebook users should beware the latest scam doing the rounds on the social network. A so-called opportunity to win free tickets with Southwest Airlines may look like a dream come true, but in fact i...
• Don’t cash this cheque
  As you can see, the budding phish hunter needs to be careful – while using genuine login credentials and having all your information stolen to verify a phish is a new one on me, many phish directori...
• This malware will block your Facebook. Beware!
  Emsisoft -- Malware continues to attack Facebook users. This time, the malware is able to spread through Facebook chat messages by sending a message along with a malicious links to the user’s friends....