Facebook email address phishing scam spreading

Security experts are warning of a new Facebook phishing scam designed to harvest log-in credentials.

Satnam Narang, a threat analyst at M86 Security, warned social networking users in a blog post that the scam uses the recently announced Facebook messaging service as a lure.

The scam promises a @facebook.com email address to those who register, but is actually a trap to gather log-ins and passwords for the site.

"The first instance of this phishing campaign tries to encourage users to get their @facebook.com email address before someone else takes it," he said.

"The bit.ly link redirects to a Facebook App which contains an iFrame that points to a compromised site that is hosting the phishing page.

"Once a user clicks Next, their information is sent to the phishers, their accounts are hijacked immediately and their Facebook status is updated to try to scam their friends/family."

This is just the first stage of the phishing attack, however. Narang said that victims are also encouraged to visit compromised pages.

One way to prevent this, and other attacks, is to revisit Facebook's settings and select a command that informs users when an attempt to access their account has been made on another computer.

A general level of intelligence and security awareness is also recommended, Narang explained.

"One of the first things we encourage our readers to do is to be aware of scams like these. Awareness is a crucial piece of the puzzle," he said.

"Another is watching out for those friends and family members that have been tricked into these Facebook scams."