Online social networks (OSNs) have become a popular new vector
for distributing malware and spam, which we refer to as
socware. Unlike email spam, which is sent by spammers directly
to intended victims, socware cascades through OSNs as
compromised users spread it to their friends. In this paper,
we analyze data from the walls of roughly 3 million Facebook
users over five months, with the goal of developing a better
understanding of socware cascades. We study socware cascades
to understand: (a) their spatio-temporal properties, (b) the
underlying motivations and mechanisms, and (c) the social
engineering tricks used to con users. First, we identify an
evolving trend in which cascades appear to be throttling their
rate of growth to evade detection, and thus, lasting longer.
Second, our forensic investigation into the infrastructure
that supports these cascades shows that, surprisingly,
Facebook seems to be inadvertently enabling most cascades; 44%
of cascades are disseminated via Facebook applications. At the
same time, we observe large groups of synergistic Facebook
apps (more than 144 groups of size 5 or more) that collaborate
to support multiple cascades. Lastly, we find that hackers
rely on two social engineering tricks in equal measure—luring
users with free products and appealing to users’ social
curiosity—to enable socware cascades. Our findings present
several promising avenues towards reducing socware on
Facebook, but also highlight associated challenges.