Facebook 'Secret Crush' App Installing Malicious Spyware

Facebook: "You have a Secret Crush invitation"

OMG, OMG, OMG! Who could it be?!

Unfortunately, if you find this note on your Facebook page, it's more likely to be an undercover malicious spyware program than a declaration of love from your Facebook crush of the moment. Love is truly dead.

Security firm Fortinet uncovered a widget that disguises itself as a normal Facebook application but actually unleashes the "Zango" adware/spyware virus when installed. Users will receive an e-mail alert that they have a "secret crush" and upon signing into the social networking site will see an alert much like a friend or group request. Clicking on it asks users to install an application on their page, but also demands they invite five friends to join.

Having gone through the trouble to install the app, most people will invite their friends, making the widget a "social worm," researchers said. "Even after that step, no crush of any sort is revealed."

Instead you get a page that requests an additional download--a download that is in fact the Zango virus.

Fortinet said that as of January 4, approximately four-percent of Facebook users have installed the "Secret Crush" application, which also goes by the name "My Admirer."

UPDATE: "Facebook is committed to user safety and security and, to that end, its Terms of Service for developers explicitly state that applications should not use adware and spyware," a Facebook spokesperson said in an e-mail. "Users should employ the same precautions while downloading software from Facebook applications that they use when downloading software on their desktop. We have contacted the developers and have disabled the Secret Crush application for violating Facebook Platform Terms of Service."





UPDATE II: Zango issued a press release last week that denied any involvement in the "Secret Crush" application.

"At no point while adding the Secret Crush application to a Facebook profile did the widget attempt to install Zango software," Zango said. "The Secret Crush widget is neither a Zango application nor is it affiliated with Zango in any way. Zango does not own it, did not manufacture it, and did not bundle software with it."