A double threat has been aimed at Twitter users as Direct Messages carrying a Facebook link and the question "what on earth could you be doing in our movie?" are currently doing rounds.

The unfortunate users who can't suppress their curiosity and follow the link are taken to a Facebook App page that tells them that they can't view the video in question unless they are logged into Twitter:


Unfortunately, the offered login page is not Twitter's, and the submitted login credentials end up on the scammers' servers and will be used for mischief at a later date.

But that's not all.

Once the victims have "logged in," they are faced with another obstacle to watching the video: they need to update their "Youtube Player."

"Users may get an impression that they’re still within the App page; however, the Facebook elements of this page are all fake," GFI researchers point out. "Clicking Install downloads a file named FlasshPlayerV11.1.37.18.exe."

The file in question is a Trojan variant that is currently detected only by half of the AV solutions used by VirusTotal, and its main goal is to drop and execute another malicious file named javas.exe.

GFI researchers say that their findings suggest that it’s a stand-alone malware that simply performs its tasks on an affected system once it executes, and that it does not establish any form of communication over the Internet nor does it steal information.

On the other hand, these particular files are not unknown, and Webroot says that javas.exe variants are known to sometime be cloaked banking information stealers that are also capable - among other things - of reading email address and phone book details, as well as open browser pop ups.

In the end, it doesn't really matter what it really does - the important thing to know is that it's altogether bad news. And it's also good to know that this same exact approach - but with a different lure - has been spotted just yesterday.

As PandaLabs' Luis Corrons warned at the time, be wary of messages offering sensational videos or unusual stories as, in 99 percent of cases, they are designed to compromise user security.