₦airaland Forum

If you receive a link on (Facebook) Messenger to a video, no matter how exciting it seems, for your own safety, think again before clicking it.
I got a warning from Trend Micro cybersecurity researchers about this new virus, dubbed FacexWorm, which comes in the form of a Chrome extension. It specifically aims to steal account credentials in cryptocurrency trading platforms.

What is this FacexWorm Virus?

First, note that the attackers designed FacexWorm to attack only users of Google Chrome. Let me give you a brief history of such viruses and Facebook Messenger.
FacexWorm operates with a newly-revamped technique first noticed in August 2017. The virus now steals account details from cryptocurrency websites and other sites like Google; it redirects the victims to crypto scams while injecting cryptocurrency miners on the site where the victim is redirected to mine cryptocurrency. It then redirects the victims to the crypto-related referral link of the attacker.

Note that Facebook Messenger has been exploited many, many times in the past, and they all spread like worms. Just like the FacexWorm, Trend Micro also found another similar cryptocurrency mining virus, which was called Digmine, which also spreads through the Messenger platform. However, while the FacexWorm targets cryptocurrency-related websites and Google chrome explicitly, Digmine also targeted Windows computers as well.

After attacking the victims, FacexWorm and Digmine send links via Messenger from the victim’s account to friends of the victim. These links are usually phony versions of video streaming websites, such as YouTube.


If the malware discovers that the victim is not on Google Chrome, the user is redirected to some seemingly harmless ad.
FacexWorms targets the following cryptocurrencies:

• Monero (XMR)
• Bitcoin (BTC)
• Bitcoin Gold (BTG)
• Bitcoin Cash (BCH)
• ETH
• Dash (DASH)
• Ethereum Classic (ETC)
• Ripple (XRP)
• Litecoin (LTC)
• Zcash (ZEC)


How Does FacexWorm Virus Operate?

If a user clicks on the malicious link while browsing with Google Chrome, he or she gets redirected to a phony YouTube webpage, and then on the page, there are prompts to urge the victim to install their malicious Google Chrome extension to play the video.
Once the user installs this extension, FacexWorm goes on to download additional modules to carry out its malicious attacks.

According to the researchers,

"FacexWorm is a clone of a normal Chrome extension but injected with shortcode containing its main routine. It downloads additional JavaScript code from the C&C server when the browser is opened. Every time a victim opens a new webpage, FacexWorm will query its C&C server to find and retrieve another JavaScript code (hosted on a GitHub repository) and execute its behaviors on that webpage."

The malicious Google Chrome extension is granted all the permissions during installation; hence it can access and/or alter data for sites entered by the victim. Below is a highlight of things FacexWorm can perform:

• Access victim’s friend list on Facebook and send the malicious video link to all of them.
• Steal victim’s account details on Coinhive, MyMonero, and Google.
• Uses victim’s computer CPU power for mining cryptocurrency for the criminals.
• Takes over the victim’s crypto transactions. Replaces the victim’s address with that of the attacker.
• Monitor’s victim's web searches, looking out for keywords like ‘eth,’ ‘bitcoin,’ ‘blockchain,’ etc., and redirects these searches to phony websites designed to steal digital currency.
• Whenever the victim tries to access Google Chrome extension management page, FacexWorm force-closes the tab to avoid detection.
• As a bonus, the criminal earns referral commissions each time a victim signs up on various targeted crypto platforms.

Good news is that many of these malicious extensions have been deleted from the Chrome Web Store, but the attackers continue to upload them back. As said earlier, Facebook has been targeted often, so I advise you to be very careful about links you click on Facebook and other social networks.

Reason Core Security anti-malware is an anti-malware software I use and highly recommend.


Source: https://ilesecure.com/new-cryptocurrency-virus-spreading-on-facebook/

Thanks man!!! You're blessed.

Lalasticlala