Trojan targeting Facebook Ads Manager could be cyberespionage tool

Facebook ads are being targeted by a new trojan which could allow a malicious actor to access not only regular advertisements but the growing number of political spots being posted to the social media giant.

The trojan, called Socelars, is distributed through a fake PDF editing app named PDFreader attempts to mine data from Facebook ads was turned up by Bleeping Computer and MalwareHunterTeam. Once activated the trojan attempts to steal Facebook session cookies from Chrome and Firefox through the Cookies SQLite database and then use them to connect to different Facebook URLs, Bleeping Computer reported.

“The account_billing URL will be used to extract the user's account_id and access_token, which will then be used in a Facebook Graph API call to steal data from the user's Ads Manager settings,” Bleeping Computer said, adding the data extracted can include “session cookies, access tokens, account ids, advertising email address, associated pages, credit card info (number, expiration date), PayPal email, ad balances, spending limits

The stolen information could enable a malicious actor to create their own campaign ads, which could have grave implications during any election cycle.

Independent security researcher Vitaly Kremez said, “Also, I think in light of the upcoming elections and intensified FB campaigns running political messages, this tool is almost like an espionage malware looking for possible political narratives (and grabbing account information),” according to BleepingComputer.