Not sure how long this link will be up, but this is the page where users get redirected after trying to read a fake news post in someone timeline.
[WARNING: ACCESS IN A CONTROLLED ENVIRONMENT]
Here's the link bait as a news on facebook
What's happening? .pnh files seems to be related with Adobe. And in this case it seems like a visit counter. Not sure if it offers any harm. However, following the the url facebook offers did triggers some anti-virus softwares.
Is this a XSS attack? Or just a simple redirect with this unknown .pnh?
This extension interfaces with http://whos.amung.us. If you use their widget on your website, the extension gets how many users are on your website and puts the count in your status bar. To configure this after it has been installed, open up the addons list from the Firefox menu, click on this addon, click options, and enter your 8-12 character key which is found in the html you were given. Ie: the image name, without the '.png' part, it's pretty self explanatory. Close options, and soon thereafter your user count will be updated in real time :)
It seems like it's a phishing attempt: