The phishers set up a spoofed Facebook page offering an app that purportedly protects Facebook accounts from getting hacked:
Unfortunately for those who fall for the "certified by Facebook" sign, the fake Facebook stock certificate image and the "insert confirmation code" trick, the Facebook username and password they submit to the site get sent directly to the scammers.
The victims are left with a notice that their Facebook account will be secure in 24 hours time and by the time they begin to think that there might be something wrong with the whole deal, the phishers have already hijacked their accounts or harvested information from it.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.