Reply to comment

Well, really, not worms. Just one worm, according to someone on the NANOG list.

The worm spreads by sending messages to Facebook friends from your account and asks them to click on a link in the .pl ccTLD. It's similar to zlob and koobface.

The worm sends personal user data to zzzping.com. The domain has been shut down by DirectNIC already, so private information is safe as of right now.

The worm is still spreading - you can see the statistics here.

Apparently, the Facebook security team is working on this as well. Anti-virus vendors have been notified. Detection and, hopefully, removal, should be available within the next few days.

Safe bet: Don't click links that show up as .pl when you mouseover them. ;-)