Hacking Tools, Survey Scam Target Facebook Users

**Executive summary:** The report documents malicious Facebook-themed tools hosted on a site that claim to recover passwords but actually drop an adware/toolbar and, in other cases, a dropper that installs a keylogger; the attackers use a legitimate password-recovery utility to extract stored browser credentials, require payment for a bogus product key, and also propagate survey clickjacking scams via Facebook wall posts. Trend Micro detections (SPYW_FAKEHACK, ADW_PLUGIN, TROJ_DROPPER.ZGD, TROJ_VBINJECT.XG) and Smart Protection Network blocks are noted.