Facebook successfully fought a malicious worm Thursday that has plagued the social networking site for two days by luring victims to a fake Facebook Web site and demanding that they submit login credentials. In Thursday’s  phishing scheme, the user received a message from FBStarter.com. Wednesday’s attack contained the address "BAction.net. Criminals will then use the acquired information to add to spam lists or for identity theft purposes, with the hopes that members often use the same passwords for multiple accounts. Once Facebook learns of a phishing attack, the company deletes the URL from members’ pages, blocks additional postings, and removes the redirect to the URL that appears in e-mail messages.

Users who suspect that they’re a victim of a phishing attack should immediately change their passwords and notify the company of the scam.