Facebook Phishing: Manual Session Hijacking

This report describes a Facebook-targeted phishing campaign in which attackers lured users with a fake video story and prompted them to copy a 'view-source:' Facebook URL (containing session/authentication tokens) into a malicious page; doing so allowed the scammers to post content on victims' timelines. The post documents the phishing page flow, screenshots of the popup trick, and Facebook's warnings after the scam was reported.