Colibri Loader combines Task Scheduler and PowerShell in clever persistence technique

Facebook Red Rides Again

Facebook colour change scams never die, they just return with a fresh coat of paint (assuming the paint is red, or even yellow if you’re particularly lucky). Favourite primary colours aside, we have another Facebook colour / theme changer to add to the pile of discarded artwork in the corner. The URL in question is

appfbviral(dot)com/theme(dot)php

Change your theme

The box reads:

Change your Facebook theme

To change your theme you must invite your friends

Hitting the continue button brings up an App install prompt for something called Change F_B Look Now.

App install prompt

Note that the page says “this does not let the app post to Facebook“, so they’ll need to ask the person doing the installing to tell others about it.

Send a request!

Click send requests to unlock results, [person x] sent you a Change F_B Look Now request

Please send requests to friends to see the results

From here, it’s a quick plummet down the long, lonely hill to a page claiming “One more step to get Facebook Red” located at

fbgameapps(dot)org/themem(dot)php:

Anybody wanting to see the mythical Facebook Red will have to deal with a survey page. Everybody else should just not bother, and be content changing their profiles on sites which allow customisation of the kind these Facebook Red scams endlessly promise. Now if you’ll excuse me, I need to find out what happens when you mix 50% blue, 33% red and 17% brown (it’s a sort of weird lavender thing, in case you were wondering).

Christopher Boyd

ABOUT THE AUTHOR

Christopher Boyd

Former Director of Research at FaceTime Security Labs. He has a very particular set of skills. Skills that make him a nightmare for threats like you.