tokens: Social networking sites Facebook and Twitter are primarily being used to spread a shortened URL using bit.ly service that points to a Google Cloud Server hosting the malicious payload with .COM or .EXE file extensions.