(Photo illustration by Nikolas Kokovlis/NurPhoto via Getty Images)
Hackers have been spotted using Facebook ads showing images of scantily clad women to lure unsuspecting users into downloading malware on their Windows PCs.
According to antivirus vendor Bitdefender, the ads led to an estimated 100,000-plus downloads of Nodestealer, a malware strain that can steal session cookies and login credentials to break into a user’s Facebook account.
In May, Facebook itself disrupted a malware campaign on the social media platform that relied on Nodestealer, which the company linked to hackers in Vietnam. At the time, Nodestealer was found masquerading as fake PDF and XLSX files.
Earlier this month, Bitdefender observed the malware returning on Facebook — this time, through the platform’s online ads. “Researchers discovered multiple hijacked Facebook accounts used in the attacks —at least 10 compromised business accounts that continue to serve malicious ads to the public,” the antivirus provider said.
(Credit: Bitdefender)To spread the malware, the ads from the hijacked Facebook accounts have resorted to showing “revealing photos of young women,” under profile names including “Album update,” “Hot Album Update Today,” and “Album Private Update Today.”
The result can lure a user into clicking the ads, which will trigger a download on the PC for an archive containing an executable dubbed “Photo Album” file. But in reality, the program is a disguised version of Nodestealer.
(Credit: Bitdefender)“Attackers also use short descriptions to bait users into downloading the media archive, such as ‘New stuff is online today’ and ‘Watch now before it’s deleted,’” Bitdefender added.
The hackers also have upgraded Nodestealer with some new functions, including the ability to steal from cryptocurrency wallets and to download additional malware. “Multiple iterations of the same ad were used in about 140 malicious ad campaigns,” the company added.
Facebook didn’t immediately respond to a request for comment. In the meantime, Bitdefender says the malicious advertising campaign remains active. So users should be on guard.