There are some interesting things in all these steps, so we will take a closer look below. Installing that Chrome Extension will then spread malicious links to the victim’s online friends, combined with the victim’s profile picture.Clicking on that link using Chrome will send you to a fake YouTube page that asks you to install a Chrome Extension directly on the page.The link goes to Google Docs with an image that looks like a fake video player with the friend’s profile picture.The victim receives a link on Facebook Messenger from a friend.We tried summarizing the steps as simply as possible below: The conclusions can be broken down into a few steps, because it’s not only about spreading a link, the malware also notifies the attackers about each infection to collect statistics, and enumerates browsers. Also, since the script dynamically decided when to launch the attack, it had to be monitored when the attackers triggered it. There were multiple steps involved trying to figure out what the Javascript payloads did. Spreading mechanismįrans spent quite some time analyzing the JavaScript and trying to figure out how the malware was spreading, which might seem like a simple task but it wasn’t. They decided to jointly write this second part of the analysis, which is going to describe the attack in detail. Frans had a good point, so they started to compare notes and found out that Frans had actually analyzed some of the parts that David hadn’t. At the same time as Kaspersky Lab were analyzing this threat, a few researchers where doing the same, including Frans Rosen, Security Advisor at Detectify.Īfter Frans saw David’s tweet about the blog post, he called David and asked why they were both doing the same job. It’s been a few days since Kaspersky Lab’s blog post about the Multi Platform Facebook malware that was spread through Facebook Messenger.

Chrome facebook messenger