The fraud is reported on the "wall" of the victims from where they invite their friends to <…>
to install this topic in their profiles.
Users who open the link in the message are moved to another page that provides the "Install" option. Once the user has chosen the installation, a file named "FacebookChrome.crx" will be downloaded, which TrendMicro has identified as TROJ_FOOKBACE.A.
When you run the file, the Trojan displays ads and some web pages that are installed in the user's browser called "Facebook Improvement".
When the extension is installed, it redirects you to a page that contains a survey about your online activity, the search page may ask for your personal information for further spamming.