First detected in Brazil, Trojan:JS/Febipos.A, the malware attempts to keep itself update, just like normal, legitimate browser extensions, Microsoft noted in a security bulletin late Friday.
Once downloaded, the Trojan monitors whether the infected computer is logged into a Facebook account and attempts to download a config file that will includes a list of commands for the browser extension. The malware can then perform a variety of Facebook actions, including liking a page, sharing, posting, joining a group, and chatting with the account holder's friends.
|