Hackers Attack Facebook Business Users Aggressively to Steal Login Credentials

A new and highly concerning cyber threat has emerged, as a botnet known as “MrTonyScam” has been orchestrating an extensive Messenger phishing campaign on Facebook. 

Recently, this campaign has flooded the platform with malicious messages, posing a significant risk to business accounts. 

The threat actors behind this operation, originating from a Vietnamese-based group, are using deceptive tactics to target millions of businesses with disturbingly high success rates.

Messenger as the Battlefield

Facebook’s Messenger platform, designed for communication and connections, has become the unexpected battleground for this evil campaign. 

The attackers have exploited it to unleash a barrage of deceptive messages containing malicious attachments, reads Guardio blog post.

What sets this campaign apart is its focus on business accounts, ranging from small marketplace sellers to large corporations. The attackers employ fake business inquiries, a tactic that has proved incredibly effective, with approximately 1 in every 70 recipients falling victim.

The attackers employ a clever and multi-stage attack process. It all begins with a seemingly innocent compressed file attachment. However, within this harmless file lies a powerful Python-based stealer. 

The threat actors have deployed a range of simple yet highly effective obfuscation methods to ensure their success.

Targeting Facebook Business Accounts

The attackers’ modus operandi hinges on the allure of a new business opportunity. By sending instant messages to unsuspecting business owners, they stimulate curiosity and tempt recipients to click on the malicious attachment. 

Once the attachment is opened, the attacker gains access to the victim’s Facebook operation, often leading to the victim being permanently locked out.

The hijacked Facebook accounts, with their reputation, seller rating, and extensive followers, represent a valuable commodity on dark markets. 

These accounts are exploited to reach a broad audience for the dissemination of advertisements and further scams. 

Additionally, individuals who manage Facebook business accounts typically possess other high-value accounts on various platforms, including banking, e-commerce, and advertising platforms. 

These accounts can be stolen directly from their browser’s cookies and password files, making them prime targets for cybercriminals.

This attack employs a combination of techniques, abuses free/open platforms, and utilizes numerous obfuscation methods. 

Keep informed about the latest Cyber Security News by following us on Google News, Linkedin, Twitter, and Facebook.