It is a well-known fact that some Facebook users simply can't stand the (relatively) new Timeline interface and have actively sought for ways to revert their accounts to the old "look".

This fact hasn't escaped the notice of online scammers, who rushed to offer bogus apps and plugins that they claimed could do it, but only served to make users fill out surveys or share personal information.

With time, the users got wiser and stopped falling for these schemes - or so it seems at first.

Researchers from Barracuda Networks have decided to analyze six of these plugins offered on the Google Chrome Web store.

The all have some version of the words "Timeline" and "Remove" in their names, but a closer look showed that half of them also asked permission to access the users' data on Facebook and to their tabs and browsing activity, while the other three went even further and look for permission to access the users' data on all websites they visit.

A clear indication that the latter plugins are up to no good is the fact that its developers have supporting websites from the Amazon S3, which will hide information of these plugin authors, and the fact that after the installation they will urge users to fill out a survey:


"The scammers behind the bad plugins are really good at social marketing," the researchers point out.

They create social events on Facebook to recruit users, and use shortened URLs to avoid detection. They also create Tumblr and TinyURL pages to automatically redirect new visitors to installation websites for the plugin, and once the users do download at and install it, they trigger the publication of a sharing post that invites their friends to try out the plugin.

And while two of these malicious plugins have already been removed from the store - whether by Google or by the author it is unclear - the fact remains that all of them together have already over 90,000 users.

"Fortunately, we did not see any other suspicious activity from the last 3 bad Chrome plugins (e.g., steal your credentials during browsing other websites). But, this does not mean they cannot and will not do that in the future," the researchers warn, and advise to everyone who has downloaded one of them to uninstall it, change their Facebook passwords, and remove the sharing posts that promote them from their News Feed.