Trojan Infection Through Facebook

This report documents a social-engineering campaign that uses Facebook messages to distribute a known Trojan dropper (“surprise.exe”). The attacker-controlled domains (linked to IP 89.187.53.64) host the payload or redirect victims to it; VirusTotal flags the binary as a Trojan dropper and third-party reports list additional domains used in the campaign. Users are advised to verify links before clicking to avoid infection.