New Facebook click-jacking scam spotted

A new click-jacking attack has hit Facebook

Security researchers have spotted a new click-jacking scam on Facebook which spreads through the site's news feed and 'Like' feature.

UK security vendor Sophos issued a warning to users over what the company describes as a "like-jacking" attack.

The attack appears as a link to a web page offering photos of the '101 hottest women in the world.' The link presents a page which, when clicked, forwards the victim to a third-party site, and accesses their news feed without notification.

Clicking on the page activates the 'Like' feature on Facebook which allows people to share pages. The page then appears on the news feeds of the victim's connections, spreading itself to a new crop of potential targets.

No actual malware code is installed, and the updates can be manually removed from the status feed.

Graham Cluley, senior technology consultant at Sophos, explained that the scam makes money by generating advertising traffic.

Facebook was hit by a similar attack in May, and Cluley warned that the site needs to step up its security measures.

"Facebook really needs to grab this problem by the horns, as it is increasingly being struck by click-jacking worms," Cluley wrote in a blog post.

"The social network should tighten up the way it handles the 'liking' of external web pages before it is more widely abused by malicious hackers and spammers."