Meta Business Alerts Abused for Phishing Campaigns

Hackers are weaponizing legitimate Meta Business Manager notifications to sneak phishing emails past security filters and into users’ inboxes.

By abusing trusted Meta infrastructure, attackers make their messages appear authentic while quietly funneling victims to credential‑stealing pages.

Because Meta systems generate these invites, the emails come from real Meta domains such as facebookmail.com and pass standard checks like SPF and DKIM.

Instead of using normal business names, threat actors manipulate the account or page name to include scare‑tactic text such as “Account Restriction,” “Ad Violations,” or “Page Will Be Disabled.”

According to the report, Attackers first create or compromise Facebook Business accounts, then send genuine partner or asset‑sharing requests through Meta Business Manager.

This lure text appears prominently in the notification, tricking recipients into believing there is an urgent policy or security issue that requires immediate action on their Facebook assets.

When victims click the embedded links, they are redirected through trusted cloud or form‑hosting services, such as Google Forms or other legitimate platforms, before landing on a phishing site.

This redirection chain helps the emails bypass URL reputation checks and lets attackers swap out final phishing domains with minimal changes to the campaign.

Fake Facebook help pages

The final destination is a spoofed Facebook Help or Privacy Center page that closely imitates Meta’s support interface. Here, victims are prompted to “verify” their account, appeal alleged restrictions, or restore ad access by entering sensitive information.

Fields typically request Facebook login credentials, business page details, contact email, phone number, and sometimes payment‑related information tied to ad accounts.

More advanced variants also steal two‑factor authentication (2FA) codes or provide instructions that trick users into revealing one‑time passcodes needed to fully hijack accounts.

According to LevelBlue’s SpiderLabs team, MailMarshal email security detected a campaign using this technique that directed users to fake Facebook Help landing pages specifically crafted to harvest user data, page information, passwords, and 2FA tokens.

Once attackers gain control of a Business Manager or linked ad account, they can run fraudulent ad campaigns, redirect traffic to malware sites, or pivot into other connected business systems.

This attack is particularly dangerous because it blends social engineering with infrastructure that security tools and users inherently trust.

Emails come from legitimate Meta systems, links often pass through reputable services, and the final pages mimic Facebook’s design closely enough to fool even experienced users.

Traditional email security that relies on sender reputation, domain‑based authentication, or simple URL blocklists may fail to flag these messages.

As a result, detection increasingly depends on behavioral analysis, language and layout anomalies in the email body, and continuous monitoring for suspicious redirections and newly registered phishing domains.

How Meta users can defend themselves

Security experts recommend never approving Business Manager requests or resolving account issues directly from email links, even when the sender appears to be Meta.

Deploying modern email security solutions like MailMarshal, which analyze content, redirects, and behavior rather than just sender domains, can significantly reduce the risk of these phishing campaigns reaching end users.

Instead, users should log in to Facebook or Meta Business Manager through a bookmarked URL or the official app and check notifications and requests from there.

Organizations should enable multi‑factor authentication, restrict who can manage Business Manager assets, and educate staff about partner‑request scams and urgency‑driven lures.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.