Facebook account hacking with iPhone X links
Solved
_Sonic_
Posted messages
7
Registration date
Status
Membre
Last intervention
-
isthgoo -
isthgoo -
Hello everyone,
For the past few weeks, someone has been posting the following message in my groups or on my profile via my account:
"Hello everyone, some time ago, I heard an ad on the radio. The host claimed to know how to win a new iPhone X. It turned out that all I had to do was type the code: "APPLE67FR" in the Google search bar and click on the first link that appeared. The next step is to fill out the registration form and wait for the contest organizer to contact you. It's so mundane! Yesterday, I received a package from UPS and inside, guess what, there was a new iPhone X 64GB. I advise you to hurry up and try as soon as possible because the offer has an expiration date and will last until the end of the week."
It's very embarrassing, and I don't understand how this could happen because:
- I change my password every time this happens (uppercase/lowercase/numbers/letters, something complex)
- I am at the maximum security level in my settings (I'm supposed to receive a notification when someone logs in as me, for example, but I don't receive anything when the hacking occurs)
- I don't play any games, don't have any apps on my account, and don't open any suspicious links. I've disabled everything because I don't need it.
And yet, despite all this, the message appears every day or sometimes every two days on my groups/profile.
What should I do?
Thank you in advance for your help; I am desperate....
Good evening and thanks again.
For the past few weeks, someone has been posting the following message in my groups or on my profile via my account:
"Hello everyone, some time ago, I heard an ad on the radio. The host claimed to know how to win a new iPhone X. It turned out that all I had to do was type the code: "APPLE67FR" in the Google search bar and click on the first link that appeared. The next step is to fill out the registration form and wait for the contest organizer to contact you. It's so mundane! Yesterday, I received a package from UPS and inside, guess what, there was a new iPhone X 64GB. I advise you to hurry up and try as soon as possible because the offer has an expiration date and will last until the end of the week."
It's very embarrassing, and I don't understand how this could happen because:
- I change my password every time this happens (uppercase/lowercase/numbers/letters, something complex)
- I am at the maximum security level in my settings (I'm supposed to receive a notification when someone logs in as me, for example, but I don't receive anything when the hacking occurs)
- I don't play any games, don't have any apps on my account, and don't open any suspicious links. I've disabled everything because I don't need it.
And yet, despite all this, the message appears every day or sometimes every two days on my groups/profile.
What should I do?
Thank you in advance for your help; I am desperate....
Good evening and thanks again.
44 réponses
- 1
- 2
- 3
Suivant
The conclusion is on this topic: https://forums.commentcamarche.net/forum/affich-35172001-virus-ipx256gog#20
and the explanation on this link: https://www.malekal.com/arnaque-iphone-1-euro-facebook/
Basically, there is indeed a parasitic extension on Mozilla (it should be available on Chrome as well).
In the observed case, it is named Adobe Flash 2.0, but the name might change over time.
This extension installs the Facebook HTC application, which explains why, when you delete the HTC app, it comes back....
When you reuse the infected browser due to the extension, it reinstalls the Facebook application upon logging into Facebook.
This is what I explained in this message
This means you have not reset the internet browsers as indicated from the beginning because it removes the extensions:
https://forums.commentcamarche.net/forum/affich-35063724-piratage-compte-facebook-avec-liens-iphone-x#23
https://forums.commentcamarche.net/forum/affich-35063724-piratage-compte-facebook-avec-liens-iphone-x?page=2#70
Afterwards, you might not have done it on the right computer, because in the first link, the person has the infected extension on their work computer and not on their personal computer.
Today's conclusion, in terms of security, be careful about the computers you use to connect, especially when they are public and shared computers (work, school, cyber, etc).
Note that for Firefox, you can launch it with all extensions and add-ons disabled.
This can be useful to use this function on the work computer if it is shared.
EDIT - Malwarebytes published an article about this: https://blog.malwarebytes.com/cybercrime/2018/04/facebook-spammers-making-things-worse/
and the explanation on this link: https://www.malekal.com/arnaque-iphone-1-euro-facebook/
Basically, there is indeed a parasitic extension on Mozilla (it should be available on Chrome as well).
In the observed case, it is named Adobe Flash 2.0, but the name might change over time.
This extension installs the Facebook HTC application, which explains why, when you delete the HTC app, it comes back....
When you reuse the infected browser due to the extension, it reinstalls the Facebook application upon logging into Facebook.
This is what I explained in this message
This means you have not reset the internet browsers as indicated from the beginning because it removes the extensions:
https://forums.commentcamarche.net/forum/affich-35063724-piratage-compte-facebook-avec-liens-iphone-x#23
https://forums.commentcamarche.net/forum/affich-35063724-piratage-compte-facebook-avec-liens-iphone-x?page=2#70
Afterwards, you might not have done it on the right computer, because in the first link, the person has the infected extension on their work computer and not on their personal computer.
Today's conclusion, in terms of security, be careful about the computers you use to connect, especially when they are public and shared computers (work, school, cyber, etc).
Note that for Firefox, you can launch it with all extensions and add-ons disabled.
This can be useful to use this function on the work computer if it is shared.
EDIT - Malwarebytes published an article about this: https://blog.malwarebytes.com/cybercrime/2018/04/facebook-spammers-making-things-worse/
- 1
- 2
- 3
Suivant
I have a question though: why is only Facebook infected and not other sites? Is it because it's an extension created specifically for Facebook?
Another question: any idea how this extension got installed on our browsers?
Thanks again!
I also wanted to ask: it’s been about ten days since I’ve had any posts, am I the only one?