When the message or link is opened, social network users are lured to fake Web sites that trick them into divulging personal details and passwords. The process, known as a phishing attack or malware, can infiltrate users' accounts without their consent.
Once the account is compromised, the thieves can infiltrate the list of friends or contacts and repeat the attack on subsequent victims. Social networking sites show there is ample opportunity to find more victims; the average Facebook user has 120 friends on the site.
Security is a constant arms race, said Simon Axten, an associate for privacy and public policy at Facebook. Malicious actors are constantly attacking the site, and what you see is actually a very small percentage of what's attempted."