Clickjacking Facebook worm spreading fast

Security experts are warning of a clickjacking worm spreading via Facebook which tricks users into posting it on their status updates, although it does not appear to be malicious.

According to F-Secure chief research officer Mikko Hyponnen, the worm posts the following message: "try not to laugh xD http://www.fbhole. com/omg/allow.php?s=a&r=[random number]". Clicking on the link takes users to another page which displays a fake error message.

“If you click anywhere on the page, you will trigger a script that will try to post the same message to your Facebook wall,” Hyponnen explained in a blog post. “This is done with an invisible iframe that follows your mouse around — causing you to click on an invisible ‘publish’ button. In addition to the wall message post, nothing else happens.”