Spammers are targeting Facebook users by paying for access to hacked accounts, according to security firm Fortinet.

Recent activity indicates that identity thieves are hacking into trustworthy profiles before selling on the login details to interested parties. This information is used by spammers to target legitimate users, posting misleading links on their "walls" – personalised message boards.

While MySpace and other social networking sites have suffered this problem before, this kind of activity is new to Facebook. At present the trend is used merely to promote unsolicited advertising, but it is possible that more serious threats could follow, said Fortinet.

"Wall posts containing links must be handled with care. While hijacked accounts have not been proved to be utilised for anything beyond posting relatively innocuous spam, it is not a stretch to think that links to drive-by-install malicious sites could be injected at some point," said the firm.