Webupon

The passwords were stolen with the help of a few cracked Facebook accounts. Using these accounts, the crackers sent e-mails to various users asking them to click on a phishing link.

Phishing is sending a link to users that will lead them to a malicious website, while the affected users think that they’re navigating to a trusted website. In fact, the website they’re navigating to is a malicious website spoofing (faking) the trusted website, thus logging and stealing their credentials when they log in.

This was also the case on Facebook. Innocent users received an e-mail message containing a link to a fake website that looked exactly like Facebook. Users who logged in on the fake website gave away their password to the crackers sending out the e-mails.

Facebooks spokesman Barry Schnitt told Reuters they blocked all affected accounts. Schnitt expects that the gathered credentials will be abused by the crackers to distribute spam messages using the cracked accounts. Facebook has been suffering a similar attack two weeks ago.