A newly discovered phishing campaign is using fake Facebook copyright infringement notices to trick users into divulging their credentials, potentially compromising business accounts.
Phishing Campaign Exploits Facebook Brand to Target Businesses
Researchers at Check Point Software Technologies revealed that this campaign, active since December 20, 2024, has already targeted over 12,279 email addresses across hundreds of companies.
The campaign primarily impacts enterprises in the European Union (45.5%), the United States (45%), and Australia (9.5%), but localized versions in Chinese and Arabic indicate its global reach.
The attackers leverage Salesforce’s automated mailing service to distribute phishing emails, exploiting its legitimate infrastructure without breaching its security systems.
By using the sender ID “noreply@salesforce.com,” the emails appear credible and are branded with Facebook logos.
These emails falsely alert recipients of alleged copyright violations, stating that their recent activity may infringe on copyright laws.
Credential Harvesting Through Fake Support Pages
Victims who fall for this ruse are redirected to counterfeit Facebook support pages designed to harvest their credentials.
These pages prompt users to input sensitive information under the pretense of having their accounts reviewed to avoid deactivation.
The phishing sites are sophisticated, embedding credential harvesting technology that captures login details in real-time.
Businesses relying on Facebook for advertising, customer engagement, or as a storefront are particularly vulnerable.
A compromised Facebook admin account can allow cybercriminals to alter content, manipulate messaging, delete posts, or lock out legitimate administrators by changing security settings.
According to Check Point Software Technologies, such breaches can erode client trust and damage a company’s reputation.
For businesses in regulated sectors like healthcare or finance, the risks extend further, potentially resulting in non-compliance penalties and legal ramifications.
Organizations can take proactive steps to mitigate this threat. Setting up alerts for suspicious logins and unusual activity is a critical first step.
Educating employees about phishing tactics is equally important Administrators should be advised to verify account statuses directly through Facebook rather than clicking on embedded email links.
Businesses should also inform customers about how they communicate via official channels to prevent them from falling victim to phishing scams post-account hijacking.
Additionally, maintaining an incident response plan is essential for recovering compromised accounts and managing communications with affected customers.
As this campaign demonstrates, cybercriminals continue to exploit trusted platforms like Facebook and Salesforce to execute sophisticated attacks, underscoring the importance of robust cybersecurity measures for businesses worldwide.
Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free
