To no wonders, the Blackhole Exploit Kit is still trying to infect users. One of the techniques commonly used is to send the victim an email from for example Facebook, Linkedin, Twitter, …. Asking to click on a link.

We’ll take a small peek at those tactics. We received the following email:



Hi ,


The Facebook Team

Obviously, Facebook didn’t disable your account at all. There are some factors to easily determine this email is fake:

  • The ‘From’ field says it’s from “Facebook”, however, the sender is clearly ‘’.
  • Have you disabled your account? If not, then there’s no reason to receive this mail.




The payload? Probably ransomware or a Banker Trojan.





Use a URL scanner if you’re unsure about a URL. Some examples are VirusTotalURLvoid and URLquery.



  • Why would Facebook send me this when my account isn’t disabled at all?
  • Why are those links not pointing to Facebook websites?

Use your common sense, update your 3d-party applications as well as Windows, and use a decent antimalware and antivirus product, like Panda Cloud Antivirus free.