Social media is a magical place. We can connect with all the people from our lives with whom we want to casually stay in contact (and filter out the ones we don't); hear about breaking news faster than ever before; accidentally start a misquote avalanche in record time; and connect with causes we care about. It empowers our me media movement and let's us share and participate. But like many magical places, evil lurks in certain corners reminding us to stay on our toes. There are all those "check out this lady's smallest bikini ever" videos that, when accidentally clicked on, appear on your wall and entice your friends. There are hackers waiting to masquerade as one of your friends and message you from London telling you they were robbed and need money right away. And, the latest, a round of bogus email messages sent that look like they are from Facebook. Tricky buggers.

Mashable reported today that security firm Sophos has pinpointed a new Trojan horse that is arriving via an email disguised as a message from Facebook. This new strain, Troj/Agent-XNN, tries to lure people in by getting them to view an attached photo. If you click on the link, your Windows-operated computer becomes infected. The link (a ZIP file full of malware) gives hackers control over your computer.

Crap. I just attended a wedding and random people are tagging me in photos all the time. What does it look like?

Click here to see an image from Sophos of the actual email. According to the security firm, it goes a little something like this:

  • Subject: Your friend added a new photo with you to the album

  • Attached file: New_Photo_With_You_on_Facebook_PHOTOID[random].zip

  • Message body:


    One of Your Friends added a new photo with you to the album.

    You are receiving this email because you've been listed as a close friend.

  • [View photo with you in the attachment]

But how do I know if it's really from Facebook?

Facebook doesn't send you photos as attachments; it provides a link directly to Facebook. Mashable: "Although Facebook email notifications typically tell you which friends tagged you in a picture, this malware campaign states 'one of your friends added a new photo with you to the album.'"

You can see why people would click on it, though. Of course we want to see a picture of us someone has posted! Pretty sneaky, sis.

Be careful out there, people. Verify before you click on anything, no matter where you are. Social media, email, theme parks...