Tuesday, April 22, 2025
HomeCyber AttackFacebook ads Abused to Steal 615000+ Logins in Phishing Campaign

Facebook ads Abused to Steal 615000+ Logins in Phishing Campaign

Published on

SIEM as a Service

Follow Us on Google News

Facebook ads and Github pages seem to be the latest route opted for by cybersecurity attackers to phish for and steal credentials of Facebook users.

Researchers at Nepalese cybersecurity firm, Threat Nix, have uncovered a wide spread campaign targeted at Nepal, Philippines, Egypt and several other countries.

It is anticipated that this campaign may have already hit at least 50 countries and over 615,000 users, and a number of victims seems to be increasing at a rapid pace of 100 victims per minute.

- Advertisement - Google News

This campaign was first discovered by the researchers when they noticed a sponsored Facebook post offering 3GB mobile data from a Nepalese telecom provider.

Once the ad was clicked on, it led to a phishing site hosted on a Github page. These pages mimicked the original page greatly and were almost impossible to tell the difference between the original and fake pages.

https://threatnix.io/blog/wp-content/uploads/2020/12/image-5.png

How does the attack work?

The phishing sites mimicked the Facebook login page and stole the unsuspecting victims’ credentials and then that would reach two endpoints, one to a Firestore database and another to a domain owned by the phishing group.

Though Facebook does a great deal to ensure such phishing pages are denied for ads, in this case, the attackers were smart and managed to find a loophole in the process. They used Bitly’s links which would point to a non-hostile page and once the ad was approved, it was modified to that of the phishing page.

https://threatnix.io/blog/wp-content/uploads/2020/12/image-6-1024x562.png

Almost 500 Github repositories containing phishing pages were discovered. It is possible that similar tactics were used earlier as the earliest of these pages dates back to 5 months, and some of the repositories were deleted.

The domain is registered and hosted at GoDaddy and was registered on 3rd April 2020.Four other domains have also been identified and linked with this scam.

Threat Nix is working with the concerned authorities to track these attackers and take down the malicious phishing pages. No further details have been released yet as this an ongoing investigation.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity, and hacking news updates.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Infostealer Attacks Surge 84% Weekly Through Phishing Emails

The volume of infostealer malware distributed through phishing emails has surged by 84% week-on-week...

North Korean IT Workers Use Real-Time Deepfakes to Infiltrate Organizations Through Remote Jobs

A division of Palo Alto Networks, have revealed a sophisticated scheme by North Korean...

New Phishing Technique Hides Weaponized HTML Files Within SVG Images

Cybersecurity experts have observed an alarming increase in the use of SVG (Scalable Vector...

Detecting And Blocking DNS Tunneling Techniques Using Network Analytics

DNS tunneling is a covert technique that cybercriminals use to bypass traditional network security...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Infostealer Attacks Surge 84% Weekly Through Phishing Emails

The volume of infostealer malware distributed through phishing emails has surged by 84% week-on-week...

North Korean IT Workers Use Real-Time Deepfakes to Infiltrate Organizations Through Remote Jobs

A division of Palo Alto Networks, have revealed a sophisticated scheme by North Korean...

New Phishing Technique Hides Weaponized HTML Files Within SVG Images

Cybersecurity experts have observed an alarming increase in the use of SVG (Scalable Vector...