Facebook Fights Off Phishing Worm

Facebook successfully fought a malicious worm Thursday that has plagued the social networking site for two days by luring victims to a fake Facebook Web site and demanding that they submit login credentials.

During the phishing attack, Facebook users receive a message from a "friend" on their contact list urging them to "Check this out." Other subject lines have included "Look at this" and "Hello."

The attackers then invite unsuspecting users to click on a link contained in the message, which subsequently redirects them away from Facebook. In Thursday's phishing scheme, the user received a message from FBStarter.com. Wednesday's attack contained the address "BAction.net."

The new Web site initially appears to be a legitimate Facebook login page, but in actuality was created by attackers in order to steal information when members type in their usernames and passwords. Criminals will then use the acquired information to add to spam lists or for identity theft purposes, with the hopes that members often use the same passwords for multiple accounts.

A Facebook spokesperson told CNN.com that the attacks were stopped within a few hours of each case, but that it was too early to determine whether Wednesday's and Thursday's phishing attacks were related.

The company is currently investigating the circumstances behind the attack. "We are aware of this phishing domain and have already begun to take action," Facebook said in a statement.

Meanwhile, Facebook advises users to avoid clicking on links that don't originate from the site, while warning that many URLs can appear legitimate by containing the word "Facebook."

"It is easy to make a domain name look legitimate when it is fraudulent. The only part of a domain name that is unique to the owner is the part immediately before the .com org, etc," Facebook said.

Once Facebook learns of a phishing attack, the company deletes the URL from members' pages, blocks additional postings, and removes the redirect to the URL that appears in e-mail messages. The company also resets the passwords for members whose accounts were used to distribute the spam.

Facebook advises users to avoid clicking on suspicious or unsolicited links, even if they appear to come from someone they know.

Users who suspect that they're a victim of a phishing attack should immediately change their passwords and notify the company of the scam.