Loading story…
Threat actors abused Meta’s Business Manager partner request feature to send phishing emails from the legitimate address noreply@business.facebook.com, giving the campaign unusual credibility for businesses that use Facebook or Instagram. Huntress reported the operation evolved from a May variant that used Google Sites and a fake Meta Agency Partner Program page into a June campaign that redirected targets through a fraudulent Facebook Messenger chatbot and Netlify-hosted phishing pages displayed via sw[.]run framing.
The phishing flow collected Meta account credentials, MFA codes, personal information, and identity documents, then exfiltrated the stolen data to Telegram bot channels. Huntress observed Vietnamese-language strings in the exfiltration process and identified a Telegram bot named @bulondondam / data1mdobot, indicating possible Vietnamese origin or shared phishkit infrastructure; Meta later added controls to block the specific abuse path, after which the activity subsided.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
After the abuse was identified, Meta implemented controls that blocked this specific phishing mechanism, and the attacks subsided according to Huntress.
Huntress disclosed that the phishing workflow collected Meta credentials, MFA codes, personal details, and identity documents, then exfiltrated them to Telegram bot channels. The researchers also noted Vietnamese-language strings and a Telegram bot named @bulondondam / data1mdobot as indicators of possible Vietnamese origin or phishkit provenance.
In June 2026, the threat actor evolved the operation to abuse Meta’s business partner request mechanism so phishing emails were sent from noreply@business.facebook.com, directing victims through a fake Facebook Messenger chatbot and Netlify-hosted phishing pages framed via sw[.]run.
Huntress reported that an earlier variant of the campaign in May 2026 used Google Sites and a fake Meta Agency Partner Program page to target businesses using Facebook or Instagram.
Check Point reported a large-scale phishing campaign that abused Facebook Business Suite invitation features to send deceptive emails from the legitimate facebookmail.com domain. The operation sent more than 40,000 phishing emails to over 5,000 customers across the U.S., Europe, Canada, and Australia, using fake Facebook Business pages and phishing sites including vercel.app-hosted pages to steal credentials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers have launched multiple sophisticated phishing campaigns targeting business users by exploiting trusted email mechanisms and brand impersonation. One campaign abused the legitimate `@facebookmail.com` domain and Meta Business Suite’s invitation feature to send convincing phishing emails to Facebook Business users, primarily targeting companies in sectors like automotive, education, real estate, hospitality, and finance. These emails, which appeared authentic due to their origin from Meta’s infrastructure, redirected victims to credential harvesting sites, with some organizations receiving thousands of such messages. The attackers created fake business pages and mimicked official branding to increase the likelihood of success, as confirmed by security researchers who reproduced the attack method. Other campaigns have leveraged HTML attachments and spoofed internal notifications to bypass traditional email security. In Central and Eastern Europe, phishing emails with malicious HTML attachments embedded JavaScript to steal credentials, impersonating brands like Adobe and Microsoft and transmitting stolen data to attacker-controlled Telegram bots. Another campaign disguised phishing emails as spam filter alerts from within the victim’s own organization, using obfuscated code and personalized fake login screens to harvest credentials via websockets. These evolving tactics highlight the increasing sophistication of phishing operations and the need for organizations to monitor for unusual connections, inspect email content, and educate users about the risks of unsolicited attachments and internal-looking notifications.
Jun 29, 2026
Researchers reported two large phishing operations that abused trusted platforms to improve delivery and evade defenses. Guardio said the **AccountDumpling** campaign used Google AppSheet to send emails from legitimate Google infrastructure while impersonating **Meta Support** and recruiters, luring Facebook Business users with fake account disablement notices, copyright complaints, and job offers. The operation compromised about **30,000 Facebook accounts** across roughly **50 countries**, stealing credentials, `2FA` codes, personal data, and government ID images; the stolen information was often funneled through Telegram channels, and the hijacked accounts were later sold or monetized through fraudulent advertising and scams. Evidence in generated PDF metadata linked the activity to Vietnam-based operators, including an individual identified as **PHẠM TÀI TÂN**. Microsoft separately disclosed an adversary-in-the-middle phishing campaign that used fake workplace compliance notices to target more than **35,000 users** at **13,000 organizations** in **26 countries**, with most activity concentrated in the United States. Attackers posed as internal HR and compliance teams, sent urgent messages with attached PDFs, and pushed victims through redirects, CAPTCHA checks, and a counterfeit Microsoft sign-in page designed to steal session tokens rather than just passwords, allowing account access without the victim's second factor. The incidents show how attackers are increasingly relying on legitimate cloud services and convincing enterprise-themed lures to bypass spam controls, defeat traditional authentication protections, and accelerate account takeover at scale.
Jun 29, 2026
Meta announced new anti-scam protections across **Facebook, Messenger, and WhatsApp** as it faces growing scrutiny over fraud on its platforms. The company said its AI systems now analyze **text, images, and contextual signals** to detect celebrity and brand impersonation, deceptive links, domain spoofing, and other social-engineering tactics. New measures include Facebook warnings for suspicious friend requests, WhatsApp alerts for risky device-linking attempts involving QR codes or phone-number entry, and expanded Messenger scam detection that can, with user consent, review recent chats for fraud indicators. Meta also detailed privacy-focused link protection in Messenger through **Advanced Browsing Protection**, which checks shared URLs against a large malicious-site watchlist without exposing readable links to Meta. The product rollout follows a broader crackdown on industrialized scam operations, including joint action with the **Royal Thai Police**, **FBI**, **UK National Crime Agency**, and **Australian Federal Police** that led to **21 arrests** and the disabling of more than **150,000 accounts** tied to Southeast Asian scam compounds. Meta said it removed **159 million scam ads in 2025** and took down about **10.9 million Facebook and Instagram accounts** linked to criminal scam centers, while shifting from deleting individual accounts to disrupting entire networks. The push comes as researchers separately documented a large malvertising operation using **300+ paid Meta ad campaigns** to impersonate news outlets and public figures, lure victims to spoofed sites, harvest contact details, and funnel them into call-center-run investment scams across at least **25 countries**.
Jun 29, 2026