New Facebook clickjacking attack

There is a new Facebook focused worm circulating around. Currently it seems that it doesn’t have any malicious payload, except spamming via posting messages to the people’s Facebook walls. The message reads:

“try not to laugh xD http ://www.fbhole.com/omg/allow.php?s=a&r=[random number]”

By clicking the link, users were forwarded (were, as the site is now offline) to a fake error window on fbhole.com. By clicking anywhere on the page, the script in the invisible frame would activate and post its spam to the user’s Facebook wall.

Image courtesy of F-Secure