Mark Gilbert’s Blog

The malicious widget, named “Secret Crush” will first popup as a request when one of their friends has started using the widget, and asks if you would like more information. On clicking the widget installs and before you are allowed to use it you must invite 5 friends.

So far this all seems fairly normal, not all that different from any other facebook widget. It is after this that things turn nasty, no information on who your secret crush is or could be has been reveled up to this point, since finding out who this person is will have been the goal of installing the widget in the first place then users will inevitably have come this far.

The user is next presented with frame asking the user to download and install software that purports to reveal who the person with the crush is, however instead it links to Zango, the spyware application.

Lovely