{"id":18084,"date":"2012-08-29T14:07:15","date_gmt":"2012-08-29T21:07:15","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=18084"},"modified":"2025-06-01T20:24:39","modified_gmt":"2025-06-02T03:24:39","slug":"facebook-bot-spreads-through-chat-messengers","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/facebook-bot-spreads-through-chat-messengers\/","title":{"rendered":"Facebook Bot Spreads Through Chat Messengers [Updated]"},"content":{"rendered":"<h2><strong>Update from Facebook:<\/strong><\/h2>\n<ul>\n<li>The Facebook security team been actively tracking this botnet and providing McAfee AV to the victims (via Scan and Repair)<\/li>\n<li>The sample covered is out of date, and the malware now works differently<\/li>\n<li>Any users infected with this malware should be pointed to the McAfee self-checkpoint on.fb.me\/InfectedMcA<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p><strong>[Original Post]<\/strong><\/p>\n<p>Malware authors are fond of using social networking sites to spread their well crafted malwares. We have recently discovered a botnet malware that receives commands from a remote attacker and spreads through different messengers to reach a victim&#8217;s machine.<\/p>\n<p>These bots mostly come with the filename Picturexx.JPG_www.facebook.com.<br \/>\nThis malware is designed to post a download URL in chat windows of different messengers including ICQ, Skype, GTalk, Pidgin, MSN, YIM, and Facebook&#8217;s web chat.<\/p>\n<h2><strong>Infection Vector<\/strong><\/h2>\n<p>The victim sees a chat window from an unknown\u00a0contact with a link promising some interesting video. This is a typical trick used by malware authors. When the user clicks the link, malware gets downloaded to the machine, and infects it.<\/p>\n<p>&nbsp;<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/?attachment_id=18265\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-18265\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/08\/flow-diag1.png\" alt=\"\" width=\"759\" height=\"271\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/08\/flow-diag1.png 759w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/08\/flow-diag1-300x107.png 300w\" sizes=\"auto, (max-width: 759px) 100vw, 759px\" \/><\/a><\/p>\n<p>The chat window that appears to victims looks very real.<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/?attachment_id=18085\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-18085\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/08\/chat_window-251x300.png\" alt=\"\" width=\"251\" height=\"300\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/08\/chat_window-251x300.png 251w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/08\/chat_window.png 260w\" sizes=\"auto, (max-width: 251px) 100vw, 251px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<h2><strong>Behavioral Analysis<\/strong><\/h2>\n<p>Once the malware has successfully executed on the victim&#8217;s machine, it bypasses the firewall in two ways:<\/p>\n<ul>\n<li>Directly with netsh, by using the command line &#8220;netsh firewall allowed program&#8221;<\/li>\n<li>By modifying the firewall policy, making a registry modification to add an allowed program, the malware<\/li>\n<\/ul>\n<p>A sample copy is dropped into the Windows folder and flagged with system, hidden, and read-only attributes.<\/p>\n<p>The malware chooses any of the following paths to drop a copy:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/?attachment_id=18099\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-18099\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/08\/drop_file_paths1.png\" alt=\"\" width=\"206\" height=\"53\" \/><\/a><\/p>\n<p>A run entry is made to ensure that the sample is reloaded when the machine reboots.<br \/>\nNetwork connections:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/?attachment_id=18107\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-18107\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/08\/network_conn2.png\" alt=\"\" width=\"605\" height=\"53\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/08\/network_conn2.png 605w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/08\/network_conn2-300x26.png 300w\" sizes=\"auto, (max-width: 605px) 100vw, 605px\" \/><\/a><\/p>\n<p>The malware does a series of checks for antimalware scanners, Windows updates, and even Yahoo updates and then disables them:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/?attachment_id=18108\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-18108\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/08\/AV_services2.png\" alt=\"\" width=\"654\" height=\"418\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/08\/AV_services2.png 654w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/08\/AV_services2-300x191.png 300w\" sizes=\"auto, (max-width: 654px) 100vw, 654px\" \/><\/a><\/p>\n<p>Once a service is selected, the malware runs a routine to disable it. The malware also changes the Internet Explorer start page, and modifies the preference file of Chrome and Firefox.<\/p>\n<p>This bot receives commands from a remote attacker. The sample copy dropped in the Windows folder is mdm.exe. We can see the commands sent by the remote attacker and what they mean below:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/?attachment_id=18281\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-18281\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/08\/last1.png\" alt=\"\" width=\"565\" height=\"515\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/08\/last1.png 565w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/08\/last1-300x273.png 300w\" sizes=\"auto, (max-width: 565px) 100vw, 565px\" \/><\/a><\/p>\n<p>The malware enumerates chat windows in the victim&#8217;s machine and posts its lure, the message that promises an interesting video. The operation works like any other spam in a chat window: The malware finds Skype&#8217;s or another window and posts the message using PostMessageA.<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/?attachment_id=18093\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-18093\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/08\/enumerate_chatwindows.png\" alt=\"\" width=\"682\" height=\"347\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/08\/enumerate_chatwindows.png 682w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/08\/enumerate_chatwindows-300x152.png 300w\" sizes=\"auto, (max-width: 682px) 100vw, 682px\" \/><\/a><\/p>\n<p>We can see below how a request is sent for a chat request on Facebook&#8217;s chat window with POST \/ajax\/chat\/buddy_list.php:<\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/?attachment_id=18103\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-18103\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/08\/AJAX_post1-300x26.png\" alt=\"\" width=\"300\" height=\"26\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/08\/AJAX_post1-300x26.png 300w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/08\/AJAX_post1.png 732w\" sizes=\"auto, (max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p><a href=\"https:\/\/securingtomorrow.mcafee.com\/?attachment_id=18104\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-18104\" src=\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/08\/Ajax_post21.png\" alt=\"\" width=\"565\" height=\"484\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/08\/Ajax_post21.png 565w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/08\/Ajax_post21-300x256.png 300w\" sizes=\"auto, (max-width: 565px) 100vw, 565px\" \/><\/a><\/p>\n<p>This worm spreads through Facebook with the help of the ajax command and appears in the chat window, making the user believe that the message came from one of the victim&#8217;s contacts.<\/p>\n<p>Fortunately, removing this worm from the victim&#8217;s machine is relatively easy. We kill the running instances of this process using Process Explorer or Task Manager.\u00a0The start-up entry made by the malware must be cleared as well to avoid its reloading after rebooting.<\/p>\n<p>McAfee&#8217;s Scan and Repair tool will remove this malware by check-pointing the victim.\u00a0We advise customers to keep their antimalware software updated and to not click unknown links.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Update from Facebook: The Facebook security team been actively tracking this botnet and providing McAfee AV to the victims (via&#8230;<\/p>\n","protected":false},"author":674,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[49,100],"coauthors":[3973],"class_list":["post-18084","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-botnet","tag-facebook"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Facebook Bot Spreads Through Chat Messengers [Updated] | McAfee Blog<\/title>\n<meta name=\"description\" content=\"Update from Facebook: The Facebook security team been actively tracking this botnet and providing McAfee AV to the victims (via Scan and Repair) The\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Facebook Bot Spreads Through Chat Messengers [Updated] | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"Update from Facebook: The Facebook security team been actively tracking this botnet and providing McAfee AV to the victims (via Scan and Repair) The\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/facebook-bot-spreads-through-chat-messengers\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2012-08-29T21:07:15+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-02T03:24:39+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/08\/flow-diag1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"759\" \/>\n\t<meta property=\"og:image:height\" content=\"271\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"McAfee\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/facebook-bot-spreads-through-chat-messengers\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/facebook-bot-spreads-through-chat-messengers\/\"},\"author\":{\"name\":\"McAfee\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\"},\"headline\":\"Facebook Bot Spreads Through Chat Messengers [Updated]\",\"datePublished\":\"2012-08-29T21:07:15+00:00\",\"dateModified\":\"2025-06-02T03:24:39+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/facebook-bot-spreads-through-chat-messengers\/\"},\"wordCount\":554,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/facebook-bot-spreads-through-chat-messengers\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/08\/flow-diag1.png\",\"keywords\":[\"botnet\",\"facebook\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/facebook-bot-spreads-through-chat-messengers\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/facebook-bot-spreads-through-chat-messengers\/\",\"name\":\"Facebook Bot Spreads Through Chat Messengers [Updated] | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/facebook-bot-spreads-through-chat-messengers\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/facebook-bot-spreads-through-chat-messengers\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/08\/flow-diag1.png\",\"datePublished\":\"2012-08-29T21:07:15+00:00\",\"dateModified\":\"2025-06-02T03:24:39+00:00\",\"description\":\"Update from Facebook: The Facebook security team been actively tracking this botnet and providing McAfee AV to the victims (via Scan and Repair) The\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/facebook-bot-spreads-through-chat-messengers\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/facebook-bot-spreads-through-chat-messengers\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/facebook-bot-spreads-through-chat-messengers\/#primaryimage\",\"url\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/08\/flow-diag1.png\",\"contentUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/08\/flow-diag1.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/facebook-bot-spreads-through-chat-messengers\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Facebook Bot Spreads Through Chat Messengers [Updated]\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\",\"name\":\"McAfee\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"caption\":\"McAfee\"},\"description\":\"We're here to make life online safe and enjoyable for everyone.\",\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/x.com\/McAfee\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Facebook Bot Spreads Through Chat Messengers [Updated] | McAfee Blog","description":"Update from Facebook: The Facebook security team been actively tracking this botnet and providing McAfee AV to the victims (via Scan and Repair) The","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Facebook Bot Spreads Through Chat Messengers [Updated] | McAfee Blog","og_description":"Update from Facebook: The Facebook security team been actively tracking this botnet and providing McAfee AV to the victims (via Scan and Repair) The","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/facebook-bot-spreads-through-chat-messengers\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2012-08-29T21:07:15+00:00","article_modified_time":"2025-06-02T03:24:39+00:00","og_image":[{"width":759,"height":271,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2012\/08\/flow-diag1.png","type":"image\/png"}],"author":"McAfee","twitter_card":"summary_large_image","twitter_creator":"@McAfee","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/facebook-bot-spreads-through-chat-messengers\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/facebook-bot-spreads-through-chat-messengers\/"},"author":{"name":"McAfee","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa"},"headline":"Facebook Bot Spreads Through Chat Messengers [Updated]","datePublished":"2012-08-29T21:07:15+00:00","dateModified":"2025-06-02T03:24:39+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/facebook-bot-spreads-through-chat-messengers\/"},"wordCount":554,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/facebook-bot-spreads-through-chat-messengers\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/08\/flow-diag1.png","keywords":["botnet","facebook"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/facebook-bot-spreads-through-chat-messengers\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/facebook-bot-spreads-through-chat-messengers\/","name":"Facebook Bot Spreads Through Chat Messengers [Updated] | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/facebook-bot-spreads-through-chat-messengers\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/facebook-bot-spreads-through-chat-messengers\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/08\/flow-diag1.png","datePublished":"2012-08-29T21:07:15+00:00","dateModified":"2025-06-02T03:24:39+00:00","description":"Update from Facebook: The Facebook security team been actively tracking this botnet and providing McAfee AV to the victims (via Scan and Repair) The","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/facebook-bot-spreads-through-chat-messengers\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/facebook-bot-spreads-through-chat-messengers\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/facebook-bot-spreads-through-chat-messengers\/#primaryimage","url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/08\/flow-diag1.png","contentUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2012\/08\/flow-diag1.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/facebook-bot-spreads-through-chat-messengers\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Facebook Bot Spreads Through Chat Messengers [Updated]"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa","name":"McAfee","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","caption":"McAfee"},"description":"We're here to make life online safe and enjoyable for everyone.","sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/x.com\/McAfee"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/18084","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/674"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=18084"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/18084\/revisions"}],"predecessor-version":[{"id":214763,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/18084\/revisions\/214763"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=18084"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=18084"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=18084"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=18084"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}