Facebook warns over password reset scam

Facebook has taken the unusual step of warning users about a bogus password reset scam designed to trick victims into downloading a password-stealing Trojan.

Prospective marks are falsely told in widely distributed spam emails that their password has been changed because of a supposed security incident. Targets are invited to open an email attachment for more information. This email attachment, you'll be unsurprised to learn, contains keystroke snaffling malware. Once bitten, every password a user enters onto an infected PC becomes compromised.

Facebook points out that it would never send users a new password in an email attachment.

McAfee, which was first to warn about the threat, has a copy of the scam emails and even a map showing the distribution of the attacks in a alert here. The web security firm reports that the scam is the sixth most prevalent piece of malware targeting consumers. ®