Facebook and the US state of Washington are suing a company they accuse of "clickjacking", alleging it has reaped $1.2m a month by using bogus pages on the social network to whisk people away to other sites.
The plaintiffs charge that Delaware-based firm Adscend Media profits from the scam by collecting money from its advertising clients for every Facebook user unwittingly misdirected to a target ad or subscription service.
The practice is also known as "likejacking" because victims are tricked into using Facebook's "like" button to perpetuate it.
It is believed to mark the first time any state government has gone to court in a crackdown against spam spread by Facebook, according to Paula Selis, senior counsel for the Washington attorney general.
Two separate but similar claims filed in federal court by the state and Facebook accuse Adscend of violating federal and state statutes outlawing misleading or deceptive commercial electronic communications and unfair business practices.
The lawsuit says Facebook pages designed as "bait" are disseminated to social network users as posts that seemingly originate from friends, enticing visitors an opportunity to view salacious or provocative content.
First they must complete a series of steps that will supposedly unlock the content but are actually designed to lure Facebook users to other sites, where they are tricked into giving away personal information or signing up for expensive mobile subscription services.
The victims are encouraged to click the "Like" button on the Facebook "bait" page, which then alerts their friends to the page's existence, thus helping propagate it. Then they are told they cannot reach the content without filling out a form for an online survey or advertising offer.
In one example cited, the "Like" button is overlayed with a link labelled: "This man took a picture of his face every day for 8 years!" The promised content often does not exist, and the user instead is directed through a series of prompts taking them off Facebook and to a string of ads and subscription offers.
In some cases a hidden code embedded in an enticing link on the "bait" page activates the "Like" button without the user even clicking it, sending it to friends' news feeds.
Selis said it may seem unlikely that anyone would click on such links, "but unfortunately they do."
While the number of Facebook users actually scammed by clickjacking is not known, Selis said investigators had determined that some 280,000 users visited the locked content pages of Adscend during February 2011 alone. "So we know there are probably millions of Facebook users" exposed to the deception, she said.
Representatives of Adscend and two co-owners also named as defendants could not immediately be reached for comment.
Selis said schemes such as clickjacking had grown more pervasive, and that millions of Facebook users had probably been exposed to Adscend's spam.
"Security is an arms race," said Ted Ullyot, Facebook's general counsel. "It's important to stay a step ahead against spammers and scammers."
The Washington state attorney general, Rob McKenna, said the state was taking action because "we've brought other cases like this and, more than any other state, we've developed technological and legal expertise" in the field of cyber fraud.
