This Facebook Messenger phishing scam may have trapped millions of users

(Image credit: wk1003mike / Shutterstock)

A major phishing campaign has been uncovered that may have earned its operators millions of dollars through affiliate advertising commissions.

Discovered by AI-focused cybersecurity firm PIXM in September 2021, before its peak in April and May 2022, the campaign leveraged Facebook’s Messenger service, legitimate URL shortener services, and web pages with adverts and surveys.

The premise is simple: the crooks created numerous phishing sites where victims would be lured into giving away their Facebook credentials. After that, two things would happen. One - they would be redirected to a website with ads, surveys, and other means of revenue generation for the operators, and two - the victims’ Facebook accounts would be used to further spread the campaign, via Messenger.

Circumventing Facebook's protections

Messenger is usually relatively good at spotting and killing phishing links, but the crooks managed to bypass the defense mechanism with legitimate URL shortening services such as litch.me, famous.co, amaze.co, and funnel-preview.com, the researchers found.

The entire campaign, it would seem, was automated, with very little interference from the campaign’s masterminds.

"A user's account would be compromised and, in a likely automated fashion, the threat actor would log in to that account and send out the link to the user's friends via Facebook Messenger," PIXM said.

Digging deeper, PIXM found one of the phishing pages hosting a link to a public, open, traffic monitoring app. Through the app, they discovered that in 2021, 2.7 million users visited one of the phishing sites, spiking up to 8.5 million this year.

> What is phishing and how dangerous is it?

> Everything you need to know about phishing

> Google lays out its plans to take on next-gen phishing scams

A total of 405 unique usernames were used as campaign identifiers, which is probably not the total number of accounts used for the campaign.

PIXM also found a common code snippet on all of the phishing pages, which referenced a website seized, and shut down, by law enforcement agencies. Allegedly, it belongs to a Colombian man, one Rafael Dorado, against whom an investigation is currently ongoing.

Details on the earnings are scarce, but the researchers are saying they’re “in the millions”.

Check out the best firewalls right now

Via: BleepingComputer

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.