Fake emails that claim to be from Facebook are being sent to users that read “Facebook Password Reset Confirmation, Customer Support,” encouraging them to click on an attachment to view their updated password.  What happens when you click on the attachment to retrieve your new password? It downloads a “password stealer” that will steal not only your Facebook password, but any other stored passwords you may have including email and banking passwords.

Hackers are utilizing Facebook because it is the most popular social networking website with about 400 million users.  The Facebook security page on the company website warns users of the spoofed email going around and reminds you that Facebook will never send a new password in an attachment. They suggest social networking users warn their friends about the scam.  The attachment in the email infects computers without any clear signs of what is happening so the user has no idea.  This spam is believed to have been sent using botnets  Cutwail and Rustock, which have the ability to control groups of computers to send out spam like this.  Tizer™ Rootkit Razor was just updated to be able to detect the latest rootkits Rustock and 4DW4R3 that have these hacker capabilities.  Download it free here to scan your computer.

You can expect that out of 400 million Facebook users, a good 10% will click on the attachment and be infected by this malicious virus.  That would mean 40 million computers infected, giving hackers such a large amount of personal information.