This Facebook Messenger phishing scam may have trapped millions of users
Facebook Messenger phishing scam earned its operators millions of dollars
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
A major phishing campaign has been uncovered that may have earned its operators millions of dollars through affiliate advertising commissions.
Discovered by AI-focused cybersecurity firm PIXM in September 2021, before its peak in April and May 2022, the campaign leveraged Facebook’s Messenger service, legitimate URL shortener services, and web pages with adverts and surveys.
The premise is simple: the crooks created numerous phishing sites where victims would be lured into giving away their Facebook credentials. After that, two things would happen. One - they would be redirected to a website with ads, surveys, and other means of revenue generation for the operators, and two - the victims’Facebook accountswould be used to further spread the campaign, via Messenger.
Share your thoughts on Cybersecurity and get a free copy of the Hacker’s Manual 2022. Help us find how businesses are preparing for the post-Covid world and the implications of these activities on their cybersecurity plans. Enter your email at theend of this surveyto get the bookazine, worth $10.99/£10.99.
Circumventing Facebook’s protections
Messenger is usually relatively good at spotting and killing phishing links, but the crooks managed tobypassthe defense mechanism with legitimate URL shortening services such as litch.me, famous.co, amaze.co, and funnel-preview.com, the researchers found.
The entire campaign, it would seem, was automated, with very little interference from the campaign’s masterminds.
“A user’s account would be compromised and, in a likely automated fashion, the threat actor would log in to that account and send out the link to the user’s friends via Facebook Messenger,” PIXM said.
Digging deeper, PIXM found one of the phishing pages hosting a link to a public, open, traffic monitoring app. Through the app, they discovered that in 2021, 2.7 million users visited one of the phishing sites, spiking up to 8.5 million this year.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
What is phishing and how dangerous is it?>Everything you need to know about phishing>Google lays out its plans to take on next-gen phishing scams
A total of 405 unique usernames were used as campaign identifiers, which is probably not the total number of accounts used for the campaign.
PIXM also found a common code snippet on all of the phishing pages, which referenced a website seized, and shut down, by law enforcement agencies. Allegedly, it belongs to a Colombian man, one Rafael Dorado, against whom an investigation is currently ongoing.
Details on the earnings are scarce, but the researchers are saying they’re “in the millions”.
Via:BleepingComputer
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
This new malware utilizes a rare programming language to evade traditional detection methods
A new form of macOS malware is being used by devious North Korean hackers
Arcane season 2 confirms the hit series isn’t just one of the best Netflix shows ever made – it’s an animated legend that’ll stand the test of time
