Facebook Malware Campaign

Malicious campaign distributing Windows executables via fake Facebook-like .tk pages: hundreds of look-alike sites host pages that load content via iframes from intermediary domains and redirect to 208.131.138.217 which generates and serves executables named to appear as images (e.g., YouNiceJPG.exe). Only one AV detected the samples on VirusTotal at the time; do not download or run files from these pages.