A new configuration of the Carberp Trojan that targets Facebook users
to commit financial fraud. Unlike previous Facebook attacks designed to
steal user credentials from the log-in page, this version attempts to
steal money by duping the user into divulging an e-cash voucher.
Carberp replaces any Facebook page the user navigates to with a fake
page notifying the victim that his/her Facebook account is “temporarily
locked”. The page asks the user for their first name, last name, email,
date of birth, password and a Ukash 20 euro (approximately $25 US)
voucher number to “confirm verification” of their identity and unlock
the account. The page claims the cash voucher will be “added to the
user’s main Facebook account balance”, which is obviously not the case.
Instead, the voucher number is transferred to the Carberp bot master who
presumably uses it as a cash equivalent (Ukash provides anonymity
similar to that offered by cash payments), thus effectively defrauding
the user of 20 euro/$25.