Hackers Attack Facebook Business Users Aggressively to Steal Login Credentials

A new and highly concerning cyber threat has emerged, as a botnet known as “MrTonyScam” has been orchestrating an extensive Messenger phishing campaign on Facebook. 

Recently, this campaign has flooded the platform with malicious messages, posing a significant risk to business accounts. 

Campaign distribution Campaign distribution
Campaign distribution worldwide in the past 30 days

The threat actors behind this operation, originating from a Vietnamese-based group, are using deceptive tactics to target millions of businesses with disturbingly high success rates.

Document
FREE Demo

Deploy Advanced AI-Powered Email Security Solution

Implementing AI-Powered Email security solutions “Trustifi” can secure your business from today’s most dangerous email threats, such as Email Tracking, Blocking, Modifying, Phishing, Account Take Over, Business Email Compromise, Malware & Ransomware

Messenger as the Battlefield

Facebook’s Messenger platform, designed for communication and connections, has become the unexpected battleground for this evil campaign. 

The attackers have exploited it to unleash a barrage of deceptive messages containing malicious attachments, reads Guardio blog post.

What sets this campaign apart is its focus on business accounts, ranging from small marketplace sellers to large corporations. The attackers employ fake business inquiries, a tactic that has proved incredibly effective, with approximately 1 in every 70 recipients falling victim.

Different variants of Facebook messenger phishing messages sent to businesses

The attackers employ a clever and multi-stage attack process. It all begins with a seemingly innocent compressed file attachment. However, within this harmless file lies a powerful Python-based stealer

The threat actors have deployed a range of simple yet highly effective obfuscation methods to ensure their success.

Targeting Facebook Business Accounts

The attackers’ modus operandi hinges on the allure of a new business opportunity. By sending instant messages to unsuspecting business owners, they stimulate curiosity and tempt recipients to click on the malicious attachment. 

Once the attachment is opened, the attacker gains access to the victim’s Facebook operation, often leading to the victim being permanently locked out.

The hijacked Facebook accounts, with their reputation, seller rating, and extensive followers, represent a valuable commodity on dark markets. 

These accounts are exploited to reach a broad audience for the dissemination of advertisements and further scams. 

Additionally, individuals who manage Facebook business accounts typically possess other high-value accounts on various platforms, including banking, e-commerce, and advertising platforms. 

These accounts can be stolen directly from their browser’s cookies and password files, making them prime targets for cybercriminals.

This attack employs a combination of techniques, abuses free/open platforms, and utilizes numerous obfuscation methods. 

Keep informed about the latest Cyber Security News by following us on Google NewsLinkedinTwitter, and Facebook.

Sujatha

Recent Posts

New Android Spyware Tricks Users by Demanding Passwords for Uninstallation

A newly identified Android spyware app is elevating its tactics to remain hidden and unremovable…

17 minutes ago

Malicious PDFs Responsible for 22% of All Email-Based Cyber Threats

Malicious PDF files have emerged as a dominant threat vector in email-based cyberattacks, accounting for…

32 minutes ago

Ex-ASML Russian Employee Smuggled Trade Secrets to Moscow via USB

A former employee of Dutch semiconductor firm ASML, identified as German A. (43), stands accused…

3 hours ago

Critical Apache Parquet Vulnerability Allows Remote Code Execution

A severe vulnerability has been identified in the Apache Parquet Java library, specifically within its parquet-avro module.…

3 hours ago

Halo ITSM Vulnerability Lets Attackers Inject Malicious SQL Code

A critical security flaw has been discovered in Halo ITSM, an IT support management software widely…

5 hours ago

Australian Pension Funds Hacked: Members Face Financial Losses

Several of Australia’s largest superannuation funds have been targeted in a coordinated cyberattack, leading to…

6 hours ago