Facebook disables 6 rogue phishing apps, but 5 more appear

Facebook on Thursday said it had disabled six rogue apps that were stealing Facebook users' log-in credentials and spamming people, and within hours more appeared.

Five more of the apps appeared on Thursday, called "Friends," "Friends Gifts," "Matching," "Pok," and "Your Photos," according to an updated blog post by Trend Micro researcher Rik Ferguson.

By that night those new ones were disabled too. Facebook "will continue to ensure that all applications on Facebook Platform comply with Facebook policies," a spokeswoman for the company said.

According to Ferguson's post: "The new rogue apps take the same format as previously but use different application icons, have slightly more credible notifications to your friends and also now feature bogus notifications to the profile owner, presumably in an effort to persuade the victim to install further apps and maximise the fraudsters' advertising returns."

He had discovered six rogue apps earlier in the week. One of those was disabled as of Wednesday, and later the other five from the first batch were disabled.

Before the apps were removed, victims had been receiving notifications that someone had commented on a post of theirs. The notifications contained links to a phishing site where users were prompted to provide their Facebook log-in credentials and then prompted to install one of the rogue apps, according to Ferguson. Once the app was installed, the victim's friends were spammed.

Updated at 10:44 p.m. PDT with Facebook disabling the five new apps and at 12:43 p.m. with discovery of five new rogue apps.

[ablackberryblog]

Facebook will be replaced by another social networking site in a few years. <br /> <br />http://www.ablackberryblog.com

[toosday]

For a moment, I thought you were going to say that the app "Causes" went rogue. If I get another "Causes" app invite from my friends, I swear... :)

[Seaspray0]

elinor, can you provide some detail on the servers running facebook?

[elinormills]

I'm afraid I can't. Facebook doesn't disclose that kind of information.

[Cyrn]

Facebook have to check such apps that are in other languages too. I've just got an "invite" ;)

[cnarad]

I have gotten over 100 false notifications in less than two weeks. I reported this but so far - no response. I also followed suggestions in their security measures..........no diference!

[kenpfeil]

Anyone else notice that to in order to leave a comment you can sign in with a phishbook account? Too funny.

[freebird1974]

Great, this is the same crap that happened to MySpace and the reason I was busy working on computers cleaning up the crap MySpace left. So now I will get more business cleaning up the crap that FaceBook leaves behind. I love and hate these sites. One, because of the mess they can make with viruses, Trojans, adaware, spyware. Two is I make money cleaning the messes up. so it is a bad thing for users good thing for me.