Welcome to a spooky Halloween blog – in May!
Sort of. We’ve seen a number of scary / ghostly / Facebook scams in circulation (which is odd, given the time of year) and thought a paranormal roundup would be a good idea. We begin with a website claiming to have footage of an actual ghost attack caught on camera, located at
click-n-play(dot)info
![Flee!](https://www.malwarebytes.com/wp-content/uploads/sites/2/2014/05/ghost1.jpg)
It’s your typical “Like this and annoy all your friends with it, then be redirected to an install” wheeze – and not a ghost in sight.
![Oh.](https://www.malwarebytes.com/wp-content/uploads/sites/2/2014/05/ghost2.jpg)
![installer](https://www.malwarebytes.com/wp-content/uploads/sites/2/2014/05/ghost9.jpg)
Users of Malwarebytes Anti-Malware will find we detect the above download as
PUP.Optional.InstallBrain.A
The image is lifted from this video, in case you were wondering.
Elsewhere, we have the Aswang – a mythical shape-shifting were-dog / vampire / terrifying thing from the Philippines (and a recent star of the paranormal police procedural Grimm).
This one is located at
trending-video(dot)com/aswang
Actual footage! Really!
![Aswang!](https://www.malwarebytes.com/wp-content/uploads/sites/2/2014/05/ghost4.jpg)
Not really.
The image itself is lifted from a film called XTRO, and was actually used in another viral hoax a while ago in the form of the New Mexico Skinwalker. It’s all going a bit Mulder and Scully, isn’t it? Sharing the “video” then clicking the play button took us to a “scan your pc” type website:
![Scanner time](https://www.malwarebytes.com/wp-content/uploads/sites/2/2014/05/ghost6.jpg)
Next up: mermaids. We had them in April, and they’re back – in Spanish! The site in question this time is
secretosdefacebook(dot)com
![Something fishy going on...](https://www.malwarebytes.com/wp-content/uploads/sites/2/2014/05/ghost7.jpg)
According to Google Translate, this says “Incredible – we found a mermaid inside a pyramid!”
They actually found their mermaid in another movie clip, but I suppose that’s close enough when dealing with Facebook scams. This one leads to an iLivid install:
![installers...](https://www.malwarebytes.com/wp-content/uploads/sites/2/2014/05/ghost8.jpg)
Users of Malwarebytes Anti-Malware will find we detect this as PUP.Optional.Bandoo.
Finally, we have
camtape(dot)pw/?shark
giving us “Great white tears captain apart in seconds”.
![shark!](https://www.malwarebytes.com/wp-content/uploads/sites/2/2014/05/ghost10.jpg)
As far as I can tell, the image is related to the legendary Megalodon shark and part of something to do with Shark Week (here’s an autoplaying video on the Discovery Channel about them, if you’re interested).
Suffice to say, our Facebook captain up there lives to fight another day – all we have after sharing is ye olde page of surveys filled with offers and downloads.
![survey](https://www.malwarebytes.com/wp-content/uploads/sites/2/2014/05/ghost11.jpg)
That concludes our spooky train ride through a mid-May haunted house of doom. Please keep your hands inside the cart until the gates have opened, and avoid clicking on fake Facebook videos at the gift counter…
Christopher Boyd