I've been confused about how it is possible to compromise a Facebook user's account simply if that user clicks a link. Recently a friend of mine on Facebook posted a series of links to what appeared to be some kind of Phishing scam. "99% of people couldn't watch this for more that 1 minute!!!" etc etc. We've all seen it. Clearly their account had been compromised and some malicious software or human was posting this content on their behalf.
Reading through some of the threads here I came across this : Don't understand how my mum's Gmail account was hacked
This seems like a similar scenario but I've been told reliably by my friend that they didn't input any credentials recently to sites that were anything other than Facebook. Of course we all know that a good Phishing site will indeed be indistinguishable from the site it is trying to capture details of users from.
So my question is two fold:
- How can clicking a link and browsing to a page, without inputting any credentials compromise your account.
- How can sites that do get control of your account by asking for credentials through what appears to be a legitimate site still appear to have the right URL.
Thanks everyone! I'm very interested to hear any response.