Phishing fraudsters have come up with a new way to capture the attention of users and access their Facebook passwords, and in the form of pop-up logs that now appear on malicious websites.
Single sign-on or SSO is a pop-up option that allows users to use their Facebook, Google, LinkedIn, or Twitter accounts to log on to other websites. The option is designed to make life easier for both users and website creators, since it is not necessary to create and remember passwords for hundreds of different sites, but access is enabled based on already created accounts on certain platforms. Thanks to the encryption, the sites to which users log in under normal conditions do not receive information about their passwords and user names, or it has been so far. Namely, as part of the new malicious attacks, a pop-up log window (SSO), almost identical to the Facebook SSO, appeared, only it does not support the Facebook API, and in fact is not in any way tied to this social platform, so instead of easier logging this system actually steals Facebook passwords and usernames.
Although the SSO copy is pretty convincing, it has almost the same elements as the original Facebook window for logging onto other sites, there are some differences that could indicate to users that it’s a fraud – the original CSS from Facebook and Google can to be moved within the site to which the user logs without changing its appearance, and the layout of the field, while the parts of the false SSO disappear when attempting to move the window.
This convincing counterfeit is that users and security experts remind that attacks become more serious, and that multifactor authentication is the best solution for such problems.