A new Bredolab variant masking itself as the “Facebook Password Reset Confirmation” The attachment has the name Facebook_Password_4cf91.zip and includes the file Facebook_ password. The From address in the email is shown as “The Facebook Team [[email protected]]”, but this address is spoofed. MX Lab researchers say the new variant is only detected by 14 of the 41 AV engines at Virus Total. A post about the scam is also included on Facebook’s security information page.”]
Source: https://www.csoonline.com/article/2138393/password-reset-email-is-new-facebook-virus.html