Bangalore, May 4 2014:  A few days ago, Net security specialists, Symantec, came across scammers from India who fooled fellow Indians in the name of Ethical Hacking.
The scammers tricked the users by claiming to offer a tool that could hack Facebook in order to obtain passwords belonging to the users’ friends with a disclaimer stating that it was for ‘education purposes’ only. For the same, the users needed to copy paste the code on browser console window and wait 120 minutes before the hack will supposedly work.
during this time, users ended up hacking their own accounts for the scammers and exposed their friends in the process.
In the background, the account was used to follow lists and users, and give likes to pages in order to inflate the followers and like counts defined by the scammers. Additionally, it also tagged all their friends in the comments to maximize the reach of the scam.
What is this type of scam called?
This scam is a variation of a method known as self-XSS (self cross-site scripting), where a user is tricked into copying and pasting code into their browser’s console that will perform various actions on their behalf. Facebook is trying to discourage users from unwittingly causing harm to their accounts through this method. Some users that attempt to paste code may receive a warning from within their browser’s developer console that points to the following link:https://www.facebook.com/selfxss
Is this type of scam new?
This type of scam originally began circulating back in 2011. This current iteration has been around since at least the beginning of 2014.Some of the variable names in the code (mesaj and arkadaslar) suggest the authors are of Turkish descent.
Why is this affecting users in India?
For this campaign, the individuals responsible are based in India. They have modified the original authors’ code by simply adding their own pages and profiles into the script to increase their follower and like counts.
What to do if you have fallen for this scam
If your account has liked and followed a number of pages and profiles without your consent, you should review your activity log. From your activity log, you can locate, unlike and unfollow the pages and profiles associated with this scam.  You should also consider posting a status update notifying your friends about the scam to make sure they don’t fall for the same trick.
Read the full Symantec finding here