Security Advisor

Microsoft Warns of Facebook Hijack via Browser Plugin

Microsoft on Friday released a security post warning of a harmful Web browser plugin that could hijack a user's Facebook account and post on their behalf.

According to Microsoft, the vulnerability, which was discovered in Brazil, is hidden in a malicious browser extension for the Mozilla Firefox and Google Chrome browsers.

"To begin with, this Trojan monitors a user to see if they are currently logged-in to Facebook," wrote Microsoft.  "It then attempts to get a configuration file from the website <removed>.info/sqlvarbr.php. The file includes a list of commands of what the browser extension will do."

Once the malware has its talons into your Facebook account, it can then perform a list of activates without any user interaction, including: liking a page, sharing a link (which, will, no doubt lead to a malicious Web site), invite friends to chat, join a group and comment on friends' posts.

Microsoft has already observed the harmful browser plugin post the following message with a malicious link (translated from Portuguese): "15 YEAR-OLD VICTIM OF BULLYING COMMITS SUICIDE AFTER SHOWING HER BREASTS ON FACEBOOK."

And, if you see this pop up as a comment from one of your friends, it's more than likely not legit (again, translated from Portuguese): "R$1000-voucher contest!"

To combat the hijacked instances already observed, Facebook has already deactivated all links used in the false messages. However, more than likely, this will not be the first wave of attack, and those controlling the malicious plugin will have a new, malicious URL to use by this point in time.

While Microsoft has only seen the hijacked messages appear in Brazilian users' Facebook accounts, it said the attack more than likely will not stay in that region and could already been engineered to target non-Portuguese speaking users.  

"There may be more to this threat because it can change its messages, URLs, Facebook pages and other activity at any time," said Microsoft. "In any case, we recommend you always keep your security products updated with the latest definitions to help avoid infection."

About the Author

Chris Paoli is the site producer for and


  • Microsoft Publishes Windows Deadlines on Upgrading to SHA-2

    Microsoft on Friday described its 2019 timeline for when it will start distrusting Shell Hashing Algorithm-1 (SHA-1) in supported Windows systems, as well as in the Windows Server Update Services 3.0 Service Pack 2 management product.

  • Performing a Storage Refresh on Windows Server 2016, Part 1

    To spruce up some aging lab hardware, Brien decided to make the jump to all-flash storage. Here's a walk-through of the first half of the process.

  • Datacenters Are Cooling Down as Buildouts Heat Up

    Tech giants Google, Apple and others are expanding their datacenter footprints at a rapid rate, and it's pushing the industry to find better ways to power all that infrastructure.

  • Vendors Issue Patches for Linux Container Runtime Flaw Enabling Host Attacks

    This week, the National Institute of Standards and Technology (NIST) described a high-risk security vulnerability (CVE-2019-5736) for organizations using containers that could lead to compromised host systems.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.