'5 Things Girls Do' Likejacking Scam Spreading on Facebook

A new scam employing clickjacking techniques is spreading on Facebook and lures people to surveys with an intriguing video about girl secrets.

The victims are forced to Like and Share a rogue page with an associated message that reads: "5 things girls do before she meets her boyfriend !! <link>"

The link takes users to a Facebook-looking page hosted on an external domain, which warns that the content is "Only for 18+ users – NO ADS."

Both the 18+ only and the no ads parts are lies. First of all, there is no video, only an image mimicking an embedded video player.

If clicked, this image forces the user to like the page via a technique commonly known as clickjacking, but technically called user interface redressing.

Clickjacking abuses legit programming methods to hide page elements, such as the Like button, by making it transparent.

The button is then positioned on top of an element the user is interested in, like the fake video player, so when they think they press play, they unknowingly like the page.

To differentiate attacks employing this technique, from others that use rogue applications or other methods to achieve the same result, people refer to them as likejacking.

However, tricking users into spamming their friends is only the beginning. The ultimate goal of these scams is to convince people to complete deceptive "surveys" or "offers," which subscribe them to premium rate services.

For every victim who ends up signing up, the scammers receive a generous commission from affiliate marketing companies.

In some cases, these firms are unaware that their systems are being abused, while in others, they are hand in hand with the scammers.

If you have fallen victim to such a scam, make sure to remove the spam messages from your wall and unlike the rogue pages.