We’re trying to figure out what, if anything, was successfully compromised from that LuckySploit server redirect, in addition to the authentication theft.

The brunga site resulted in a straightforward facebook user/pass theft. Luckysploit most often results in much more malicious activity (banking pass theft) or the all too common Fakealert installs.

thanks!