Spyware has landed on Facebook.

According to researchers at Fortinet, a malicious Facebook Widget actively spreading on the popular social networking site is serving as a lure to trick users into installing the notorious Zango adware/spyware program.

According to a detailed advisory from Fortinet (complete with screenshots), the so-called "Secret Crush" widget powers a software installation that traces back to Zango.

Needless to say that clicking on "Download Now" leads to a copy of the infamous Zango adware/spyware. This was formerly known as BetterInternet, and is currently caught by Fortinet as Adware/Zango as can be seen in Figure 6. By downloading, the malicious widget authors get rewarded with a fistful of pennies upon each download (which, after a few million clicks, probably sums up to an impressive total).

Fortinet said the widget is already being used by 3 percent of the Facebook community, which amounts to more than one million users.