Anatomy Of Self-Inflicted Javascript Injection On Facebook

This report explains a Facebook abuse campaign that uses self-inflicted JavaScript injection (users copying/pasting JS into the browser URL bar) to perform actions on victims' accounts—auto-liking content, sending invites/messages to all friends, and distributing malicious or offensive links (examples include hex-encoded scripts and bit.ly redirects to facebook.joyent.us hosts). It describes the technique, demonstrates sample payloads, and warns users about the risks of running arbitrary JS in their browser address bar.