Loading malware…
3 distinct techniques documented for this family, organized by ATT&CK tactic.
“A ‘People’ extraction feature scrapes the Business Manager ‘People’ view, builds CSV files with names, email addresses, roles, status, and access levels… Another analytics component enumerates Business Manager IDs, linked ad accounts, connected pages, and billing or payment configurations…”
“The associated Facebook username and email are then sent to an attacker‑controlled infrastructure at getauth[.]pro… [and] silently exfiltrates those CSVs to the same backend…”
“…sent to… getauth[.]pro, with an option to forward it to a Telegram channel… exfiltrates those CSVs… often marked for Telegram forwarding.”
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.