A new Facebook scam is spreading rapidly through a post on users’ news feed, according to an alert issued by M86 Security Labs.

The scam involves a photograph being posted in an album called “BBC News” with an image of a girl from a web cam. The text says ““Everyone do check what she did on cam …. — [URL]”

The URL has changed over the course of a few hours. At first, it was a bit.ly link (over 80k clicks in an hour) to goo.gl (currently over 300k clicks in 3 hours) to tinyurl. Once a user visits the URL, they are redirected to a Facebook Application Installation that asks for permissions which include the ability to access photos and videos.

When the application is installed, the photograph is posted to their profile in the same album name and a sampling of friends is tagged (usually 100+) to help get the attention of their friends and friends of friends.

While this is happening behind the scenes, the user is redirected to an outside domain which shows a video window, but in order to view the video, the user is asked to fill out a survey which is the actual scam which pays the application makers (hackers) via a referral/affiliate program.

M86 Security Labs recommends not clicking on the link included in the description of the photograph and untagging yourself from the photo. It also says to report the image to Facebook.

“If you’ve been tricked into installing the application, visit the Privacy Settings page and click on ‘Edit Your Settings’ under Apps and Websites,” M86 writes in a blog post.

“Locate the Rogue Application under the Apps and Websites section (typically has the word “news” in it). Once you’ve located it under the  ‘Apps You Use’ section, click on ‘Edit Settings’ in order to remove the application.”