According to the cybercrime cell of Agra police, which claims to have noticed the attack first, was caused by a virus from the Kilim malware family, which has in turn led to such incidents elsewhere across the globe. “It began with a message on social media which stated ‘watch urgent, because it is your video’,” said cybercrime cell in-charge Nitin Kasana. “Every time someone clicked on the link, their entire timeline and inbox was spammed with NSFW material.” “Mobile users were redirected to affiliate pages that contain various offers, while desktop users were asked to download a file from a folder containing the malware. The file pretended to offer a collection of NSFW videos. The malicious file was a downloader for the Facebook worm, which comes in the form of a Chrome extension and additional binaries. The last part of the attack was to spread among the victims’ Facebook friends, by sending the lure message,” Kasana added. The users are left embarrassed due to the attack. Immediately, many of them called their relatives and friends and alerted them not to click on the images or links as they had offensive material. Atul Verma, a Facebook user, told TOI, “I had to call and message over 50 people to inform them that my account has been hacked. I requested them not to open any files containing weird links. It was disgusting.” Rakshit Tandon, cyber expert speaking to TOI warned, “One should be extremely careful and inspect any link, specially shortened URLs, before clicking on them. Several thousands of Facebook accounts were subjected to the spam attack globally, including some parts of India, via NSFW malware, which unleashed massive quantities of violent and NSFW images across users’ newsfeeds.” Tandon advised that one should immediately reset his social network account password, take off all the Facebook apps from Facebook they are aware of, remove any extensions that is not needed from their web browser by going into Setting/Options. “Finally, every user should mark unknown links as spam, so that Facebook can take it down automatically,” he added. Police officials said TOI that the cybercrime unit is in contact with Facebook’s headquarters in the US. However, a reply with more additional details from Facebook would take some time.
