"More than 5,000 businesses that use Facebook for advertising were bombarded by tens of thousands of phishing emails in a credential- and data-stealing campaign. Check Point researchers say that they spotted about 40,000 phishing emails sent to their customers across the US, Europe, Canada, and Australia - and they were sent from the legitimate facebookmail.com domain. While most organizations received fewer than 300 messages, one company alone was hit with more than 4,200."
"To pull off this phishing expedition, the criminals created shell Facebook Business pages representing businesses that don't exist, and then used the Business invitation feature to send phishing emails that look like the real deal. This makes the fake notifications look more convincing because they appear to come directly from Meta, plus the legit domain helps the phishing emails bypass security filters."
"Targeted industries include automotive, education, real estate, hospitality, and finance, and while the emails mostly went to smaller and mid-size businesses, the phishing expedition also caught a "smaller number of large, well-known companies," according to the Check Point security researchers. "These sectors, particularly those that rely on Meta platforms for customer engagement, are ideal targets because their employees frequently receive genuine 'Meta Business' notifications and are therefore more likely to trust such messages," the researchers note."
More than 5,000 businesses that advertise on Facebook were targeted in a large credential- and data-stealing phishing campaign. Check Point researchers detected about 40,000 phishing emails sent to customers across the US, Europe, Canada, and Australia, originating from the legitimate facebookmail.com domain. Attackers created shell Facebook Business pages for non-existent companies and used the Business invitation feature to send authentic-looking notifications. The combination of a valid Meta domain and urgent wording such as "account verification required" helped messages bypass filters and prompt clicks. Phishing links redirected recipients to sites that harvest credentials and sensitive data. Industries targeted included automotive, education, real estate, hospitality, and finance.
Read at Theregister
Unable to calculate read time
Collection
[
|
...
]