Home Security Facebook Ads Phishing Campaign Stole Credentials Of 615K Users

Facebook Ads Phishing Campaign Stole Credentials Of 615K Users

by

Researchers have uncovered a huge phishing campaign exploiting Facebook ads and GitHub pages. Through these baits, the attackers targeted over 615000 users stealing their accounts’ credentials.

Facebook Ads Phishing Campaign

Researchers from the Nepalese cybersecurity firm Threat Nix have shared details about their findings regarding a widespread Facebook ads phishing campaign in their post.

As revealed, they uncovered an orchestrated phishing campaign that targeted Facebook users with fake ads. On Facebook, such ads usually appear as sponsored posts from the pages belonging to various companies and sellers.

Since users often have no problem with these sponsored posts, in fact, they often view them to know details, it seems this interest lured the attackers behind the phishing campaign to exploit this feature.

Thus, as discovered, the attackers created various pages impersonating otherwise legit pages from different entities. These pages ran sponsored ads with shortened links that redirected to phishing websites hosted on GitHub pages.

The phishing sites mimicked the Facebook login page to steal users’ credentials that would then reach two endpoints. As described by the researchers,

All these static GitHub pages forwarded the phished credentials to two endpoints one to a Firestore database and another to a domain hosted on GoDaddy.

Sharing the examples, the researchers have highlighted one such post from the copied Nepal Telecom Facebook page (image shown below). Its sponsored ad offered free internet GBs to the users asking them to click on a shortened URL.

Facebook Ads phishing campaign post
Source: Threat Nix

Regarding how this campaign executed successfully on Facebook, the researchers explain,

While Facebook takes measures to make sure that such phishing pages are not approved for ads, in this case the scammers were using Bitly link’s which initially must have pointed to a benign page and once the ad was approved, was modified to point to the phishing domain.

Asian Users Targeted The Most

According to the stats, Threat Nix observed that the phishing campaign targeted Asian users the most. Though, its overall impact reached out to Africa and Europe as well.

Predominantly, the victims belonged to Nepal, followed by the Philippines, Egypt, Pakistan, Mongolia, Norway, Tunisia, Iraq, Malaysia, and Algeria. Yet, the list showed credentials from users across 50+ countries.

Source: Threat Nix

Until the time of their disclosure, the campaign had already targeted over 615,000 users and was still going on. Whereas, the overall list of phished credentials added up to 100 entries every minute.

For now, the researchers have not shared further details as they work towards the removal of this phishing campaign.

The following two tabs change content below.

Abeerah has been a passionate blogger for several years with a particular interest towards science and technology. She is crazy to know everything about the latest tech developments. Knowing and writing about cybersecurity, hacking, and spying has always enchanted her. When she is not writing, what else can be a better pastime than web surfing and staying updated about the tech world! Reach out to me at: [email protected]

Source link

Related Articles

Leave a Comment