In the ever-evolving landscape of cyber threats, phishing scams continue to pose a significant risk to individuals and organisations alike. As businesses increasingly rely on online platforms for their operations, cybercriminals are quick to adapt, devising new tactics to exploit vulnerabilities and infiltrate valuable networks. In a recent development, a concerning scam has emerged targeting Facebook Business accounts.
This article delves into the specifics of this latest phishing scam.
Also read: Researchers develop AI agents that can autonomously hack websites & more
Cybersecurity and digital privacy company Kaspersky has discovered a new phishing tactic that is aiming Facebook business accounts. This scheme cleverly utilises authentic Facebook infrastructure to send deceptive emails, warning recipients of potential account suspension.
Also read: Mother of all Breaches: 26 billion records leaked, check if your data is safe
Cybercriminals have developed a technique leveraging genuine Facebook features to send fake suspension alerts to business accounts. These deceptive emails, originating from Facebook, convey alarming messages like “24 Hours Left to Request Review. See Why,” instilling a sense of urgency and prompting action from recipients.
Upon clicking the email link, users are directed to a genuine Facebook page featuring a familiar warning message. Subsequently, they are redirected to a phishing website adorned with Meta branding, reducing the time to resolve the issue from 24 to 12 hours. Initially, innocuous details are asked on the phishing site, only to be followed by a request for the account holder’s email address or phone number, along with their password.
The attackers use compromised Facebook accounts to send these notifications. They modify the account name to display a threatening message and replace the profile picture with an exclamation mark. Subsequently, they craft posts referencing the targeted business accounts. Since the notifications are transmitted through legitimate Facebook infrastructure these notifications are guaranteed to reach their intended recipients.
“Even notifications that appear legitimate and come from a trusted source such as Facebook can be deceptive. It’s crucial to carefully examine the links you are prompted to follow, especially when it involves entering data or making payments. This can make a significant difference in protecting your business accounts from phishing attacks,” said Andrey Kovtun, a security expert at Kaspersky.
