30,000 Facebook Accounts Hacked via Google AppSheet Phishing Campaign

""What we found wasn't a single phishing kit; it was a living operation with real-time operator panels, advanced evasion, continuous evolution and a criminal-commercial loop that quietly feeds on the same accounts it helps steal back.""

"The phishing emails are sent from a Google AppSheet address, allowing them to bypass spam filters and create a false sense of urgency for users."

"These campaigns have adopted various kinds of lures designed to induce a 'Meta-related panic,' including account disablement and verification review."

"The operation has compromised roughly 30,000 Facebook accounts, which are then sold back through an illicit storefront run by the threat actors."

A Vietnamese-linked phishing operation, codenamed AccountDumpling, utilizes Google AppSheet to distribute phishing emails targeting Facebook Business account owners. Approximately 30,000 Facebook accounts have been compromised, with stolen accounts sold through an illicit storefront. The phishing emails, appearing to be from Meta Support, create a false sense of urgency, directing users to fake web pages to harvest credentials. The operation features real-time operator panels and advanced evasion techniques, showcasing the evolving tactics of Vietnamese threat actors in the underground ecosystem.

Read at The Hacker News