In websites related to facebook malware analysis and information, we often see messages to the effect of if you have run this facebook app then your account has been compromised, or if you went to your browser console and run this script then your account has been compromised. Change your password immediately.

I can understand running a script while logging in may make it possible for messages to be sent or posted on walls automatically, but how is it possible for someone to obtain my password by me running a script or a facebook application? Does the password information that I sent to authenticate myself when I opened facebook somehow stay around in the browser until I log off? I can imagine cookies or some other temporary internet files storing my login session information somewhere that the browser can access, but wouldn't such information just give an attacker control over the current session? How would someone get hold of my password that I only enter during the login screen to authenticate myself in, by simply me running a script?

  • 3
    That something compromised your account does not necessarily imply that the same something has a copy of your password. The two are different.
    – user
    Commented May 9, 2014 at 12:43

2 Answers 2


Short Answer: No, it can't.

Explanation: The only way to obtain your password via a script is when you login (using keylogger etc.), since facebook secures, hashes & encrypts the password, its not visible anywhere. So a script wouldn't get to the password via the website, only via things such as a keylogger.

addition: To prevent this scenario, keep your antivirus/malware up to date, and use cation when installing programs from the internet :)

  • except by some sort of phishing attack - e.g. the malicious script pops up a login form that sends the credentials to the attacker. Commented Jul 19, 2014 at 11:35

I suspect it really means «They have stolen your cookies and can impersonate you. Change your password in order to invalidate the session»

Another explanation would be that they could show a fake login prompt (eg. simulating that you got logged out, or entered a wrong password) and obtain your password from there.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .