Hackers Attack Facebook Business Users Aggressively to Steal Login Credentials

A new and highly concerning cyber threat has emerged, as a botnet known as “MrTonyScam” has been orchestrating an extensive Messenger phishing campaign on Facebook. 

Recently, this campaign has flooded the platform with malicious messages, posing a significant risk to business accounts. 

Campaign distribution Campaign distribution
Campaign distribution worldwide in the past 30 days

The threat actors behind this operation, originating from a Vietnamese-based group, are using deceptive tactics to target millions of businesses with disturbingly high success rates.

Document
FREE Demo

Deploy Advanced AI-Powered Email Security Solution

Implementing AI-Powered Email security solutions “Trustifi” can secure your business from today’s most dangerous email threats, such as Email Tracking, Blocking, Modifying, Phishing, Account Take Over, Business Email Compromise, Malware & Ransomware

Messenger as the Battlefield

Facebook’s Messenger platform, designed for communication and connections, has become the unexpected battleground for this evil campaign. 

The attackers have exploited it to unleash a barrage of deceptive messages containing malicious attachments, reads Guardio blog post.

What sets this campaign apart is its focus on business accounts, ranging from small marketplace sellers to large corporations. The attackers employ fake business inquiries, a tactic that has proved incredibly effective, with approximately 1 in every 70 recipients falling victim.

Different variants of Facebook messenger phishing messages sent to businesses

The attackers employ a clever and multi-stage attack process. It all begins with a seemingly innocent compressed file attachment. However, within this harmless file lies a powerful Python-based stealer

The threat actors have deployed a range of simple yet highly effective obfuscation methods to ensure their success.

Targeting Facebook Business Accounts

The attackers’ modus operandi hinges on the allure of a new business opportunity. By sending instant messages to unsuspecting business owners, they stimulate curiosity and tempt recipients to click on the malicious attachment. 

Once the attachment is opened, the attacker gains access to the victim’s Facebook operation, often leading to the victim being permanently locked out.

The hijacked Facebook accounts, with their reputation, seller rating, and extensive followers, represent a valuable commodity on dark markets. 

These accounts are exploited to reach a broad audience for the dissemination of advertisements and further scams. 

Additionally, individuals who manage Facebook business accounts typically possess other high-value accounts on various platforms, including banking, e-commerce, and advertising platforms. 

These accounts can be stolen directly from their browser’s cookies and password files, making them prime targets for cybercriminals.

This attack employs a combination of techniques, abuses free/open platforms, and utilizes numerous obfuscation methods. 

Keep informed about the latest Cyber Security News by following us on Google NewsLinkedinTwitter, and Facebook.

Sujatha

Recent Posts

Attackers Exploit Microsoft Entra Billing Roles to Escalate Privileges in Organizational Environments

A startling discovery by BeyondTrust researchers has unveiled a critical vulnerability in Microsoft Entra ID…

1 day ago

Threat Actors Exploit Google Apps Script to Host Phishing Sites

The Cofense Phishing Defense Center has uncovered a highly strategic phishing campaign that leverages Google…

1 day ago

Dadsec Hacker Group Uses Tycoon2FA Infrastructure to Steal Office365 Credentials

Cybersecurity researchers from Trustwave’s Threat Intelligence Team have uncovered a large-scale phishing campaign orchestrated by…

1 day ago

Beware: Weaponized AI Tool Installers Infect Devices with Ransomware

Cisco Talos has uncovered a series of malicious threats masquerading as legitimate AI tool installers,…

1 day ago

Pure Crypter Uses Multiple Evasion Methods to Bypass Windows 11 24H2 Security Features

Pure Crypter, a well-known malware-as-a-service (MaaS) loader, has been recognized as a crucial tool for…

1 day ago

Attackers Exploit Microsoft Entra Billing Roles to Escalate Privileges

A recent discovery by security researchers at BeyondTrust has revealed a critical, yet by-design, security…

1 day ago