Rihanna 'S3X' Tape Survey Scam Messages Hit Facebook

Outline
Messages spreading via Facebook comments promise clickers salacious footage of popular singing star Rihanna and her boyfriend.

© Depositphotos.com/3dfoto

Brief Analysis
These fraudulent messages are designed to trick users into relinquishing control of their Facebook accounts to Internet fraudsters who will use the hijacked accounts to blast out more of the Rihanna spam and possibly other scam messages as well. They also attempt to trick users into participating in bogus online surveys. No matter how many surveys they complete, participants will never get to see the promised video.


Example

Detailed Analysis
Messages promising users "S3X" video featuring singing star Rihanna with her boyfriend are currently appearing on Facebook. The messages, which are generally posted as comments to Facebook messages, include a link to the supposed video.

However, the messages are scams deigned to fool over-eager users into compromising their Facebook accounts. Those who give in to temptation and click the link will first be taken to a video player page as shown in the following screenshot:


If users click the "play" button, they are then taken to a page that claims that they must verify that they are human by generating a "code" and copy the contents of their address bar:

Next they are instructed to submit their "verification code" as a "final step":



Users are then ask to wait while their code is verified:



Finally, users are taken to another website that claims that they must once again verify that they are human by participating in a "survey" or "trial":

But, alas, no matter how many surveys users complete, they will never get to see the promised video of Rihanna and her boyfriend.

Meanwhile, by submitting the "verification" code as instructed, users are in fact giving the scammers access to their Facebook accounts, including their Friends list. BidDefender's HotforSecurity blog explains that the "verification code" is in fact the victim's Facebook authentication token, which can then be used by the criminals to temporarily hijack the Facebook account. Hijacked accounts are then used to blast out many more of the same scam messages as comments on various Facebook posts.

While the compromised accounts are being used to spam all of their friends, victims are likely to be embroiled in a morass of bogus survey pages, perhaps still vainly hoping to see Rihanna in the raw. Some of the "survey" pages ask users to provide personal information including name, address and contact details, ostensibly to allow them to go in the draw for a prize. Others invite them to download dubious toolbars, games or software. Still others will claim that users must provide their mobile phone number - thereby subscribing to absurdly expensive text messaging services - in order to get the results of a survey or go in the running for a prize.

Celebrities, including Miley Cyrus, Taylor Swift and others have been used as bait in similar spam attacks in the past. Be wary of any message that claims that you can read breaking news or see salacious video footage of a celebrity by clicking a link in an email or social media post. If such a message comes your way, do not click on any links that it may contain. This is an oft used scammer ruse. 

Thanks to ThatsNonsense and Black Knight for their write-ups on this topic.

Last updated: February 28, 2013 First published: February 28, 2013 Written by Brett M. Christensen About Hoax-Slayer

References
Yet Another Miley Cyrus Sex Tape Kicks Tagjacking Back into Shape
What is a Facebook Survey Scam? - Survey Scams Explained