The latest one repeats the usual pattern: a friend of the victims has fallen for the scam and his status now contains the very typical OMG OMG OMG... I cant believe this actually works! Now you really can see who viewed your profile! on [BIT.LY LINK] message. The victims are intrigued, and click on the link which lands them on a webpage that offers them the application that will supposedly allow them to see their profile's visitors:
To install the application (called ePrivacy), the users must give it permission to access their basic information, send them e-mails, post on their walls, access their data any time and even manage any of the pages they are administrators of.
Surprisingly enough, this request apparently doesn't trigger the alarm bell with many users. As soon the victims allow the application to do all that, the same message they fell for is posted as their status message, ready to lure in other curious users.
According to Sophos, the current campaign uses a number of different links, but they all point to the same page. An inquiry into just one of those showed that some 60,000 people have already clicked on it. It doesn't mean they all "installed" the application, but if only one of them did, it is still one victim to many.
If the "ProfileSpy" logo with the black hat icon looks familiar, it is because the same scammers have run a nearly identical campaign some 5 months ago. Back then, they also tried to get victims to register for a mobile service that costs $19.99 per month.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.