Wednesday, April 17, 2024

Hackers Attack Facebook Business Users Aggressively to Steal Login Credentials

A new and highly concerning cyber threat has emerged, as a botnet known as “MrTonyScam” has been orchestrating an extensive Messenger phishing campaign on Facebook. 

Recently, this campaign has flooded the platform with malicious messages, posing a significant risk to business accounts. 

Campaign distribution
Campaign distribution worldwide in the past 30 days

The threat actors behind this operation, originating from a Vietnamese-based group, are using deceptive tactics to target millions of businesses with disturbingly high success rates.


Deploy Advanced AI-Powered Email Security Solution

Implementing AI-Powered Email security solutions “Trustifi” can secure your business from today’s most dangerous email threats, such as Email Tracking, Blocking, Modifying, Phishing, Account Take Over, Business Email Compromise, Malware & Ransomware

Messenger as the Battlefield

Facebook’s Messenger platform, designed for communication and connections, has become the unexpected battleground for this evil campaign. 

The attackers have exploited it to unleash a barrage of deceptive messages containing malicious attachments, reads Guardio blog post.

What sets this campaign apart is its focus on business accounts, ranging from small marketplace sellers to large corporations. The attackers employ fake business inquiries, a tactic that has proved incredibly effective, with approximately 1 in every 70 recipients falling victim.

Different variants of Facebook messenger phishing messages
Different variants of Facebook messenger phishing messages sent to businesses

The attackers employ a clever and multi-stage attack process. It all begins with a seemingly innocent compressed file attachment. However, within this harmless file lies a powerful Python-based stealer

The threat actors have deployed a range of simple yet highly effective obfuscation methods to ensure their success.

Targeting Facebook Business Accounts

The attackers’ modus operandi hinges on the allure of a new business opportunity. By sending instant messages to unsuspecting business owners, they stimulate curiosity and tempt recipients to click on the malicious attachment. 

Once the attachment is opened, the attacker gains access to the victim’s Facebook operation, often leading to the victim being permanently locked out.

The hijacked Facebook accounts, with their reputation, seller rating, and extensive followers, represent a valuable commodity on dark markets. 

These accounts are exploited to reach a broad audience for the dissemination of advertisements and further scams. 

Additionally, individuals who manage Facebook business accounts typically possess other high-value accounts on various platforms, including banking, e-commerce, and advertising platforms. 

These accounts can be stolen directly from their browser’s cookies and password files, making them prime targets for cybercriminals.

This attack employs a combination of techniques, abuses free/open platforms, and utilizes numerous obfuscation methods. 

Keep informed about the latest Cyber Security News by following us on Google NewsLinkedinTwitter, and Facebook.


Latest articles

Trustifi’s Email Security Awareness Training – Empowering MSPs to Train & Protect Clients

In today's digital landscape, email security has become a critical concern for businesses of...

Personal Data Exposed in Massive Global Hack: Understanding the Implications & Guarding Privacy- Axios Security Group

In a digital age where information is the new currency, the recent global hack...

Ex-Security Engineer Jailed For Hacking Decentralized Cryptocurrency Exchanges

Ahmed exploited a vulnerability in a decentralized cryptocurrency exchange's smart contract by injecting fabricated...

Omni Hotels & Resorts Hack: Attackers have Stolen Customer Information

Omni Hotels & Resorts has revealed that it was the target of a recent...

Connect:fun Attacking Organizations Running Fortinet’s FortiClient EMS

A new exploit campaign has emerged, targeting organizations that utilize Fortinet’s FortiClient EMS.Dubbed...

TA558 Hackers Compromised 320+ Organizations’ FTP & SMTP Servers

TA558, a financially motivated threat actor identified in 2018, is targeting several countries but...

Blackjack Hackers Destroyed 87,000 Sensors Using Lethal ICS Malware

A group of cybercriminals known as "Blackjack" has launched a devastating attack on industrial...

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles