Phish/Malware Sighting: "Facebook Updated Account Agreement", "Facebook Update Tool", "Facebook New Login System" Attacks

Social media sites are hot and spammers and scammers have fully embraced the trend as well. We're seeing more and more malicious emails that masquerade as social media notifications such as friend requests, policy changes, etc.

Today, I'm seeing a lot of phishing and malware-infected emails in my personal spam traps spoofing Facebook's login system. There are at least three variations on this (probably many more) that I've spotted. All of them have "from" lines using "facebookmail.com" as the domain. (Note that Proofpoint's anti-spam and anti-virus features block all of these messages.)

First up, there's a message with subject line "Facebook updated account agreement" that also features a zip attachment that is surely some sort of malware. As is usual for phishing/malware email attacks, this message encourages the user to urgently "submit a new, updated account agreement", otherwise, your account will be "restricted." (Click the thumbnail at left for a full-size jpeg sample of this email. Need I stress that you should not download, unzip and run that attachment?

Similarly, I'm seeing phishing emails that have malicious links as their destination. Two different variations depicted in the thumbnails at left (again, you can click to show a full-size jpeg sample). One uses the subject line "Facebook Update Tool", the other is "new login system."

 Both emails use similar body copy that includes the following text:

Dear Facebook user,

In an effort to make your online experience safer and more enjoyable, Facebook will be implementing a new login system that will affect all Facebook users. These changes will offer new features and increased account security.
Before you are able to use the new login system, you will be required to update your account.

Please click on the link below to update your account online now:

[malicious URL deleted]

If you have any questions, reference our New User Guide.

Thanks,
The Facebook Team 

The URLs in these messages link to fraudulent sites, of course, Recipients are advised never to click on links in email.

Comments

[Daniel]

Thank you very much for this info. I was very close to unzip their attachment, but thanks to you now I understand that is a fake mail.
Thank you again!