/*! elementor – v3.18.0 – 20-12-2023 */
.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#69727d;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#69727d;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}

By Dylan Duncan

The majority of businesses today utilize social media platforms for advertising products, sharing updates, and customer engagements. But what happens when a business account falls into the hands of a threat actor? This report explores the inner workings of an advanced phishing campaign capable of bypassing multi-factor authentication (MFA) to target Meta business accounts. Cofense has discovered a comprehensive toolkit enabling threat actors to create malicious links, verify if they are active threats, generate emails, and other additional tasks. As it stands, this campaign proficiently crafts phishing emails directed at users in 19 countries and across various languages. These emails, appearing to originate from Meta, claim that the account violated a policy or infringed on a copyright. Should this campaign succeed, followers of the compromised Facebook business account are likely to be at risk of additional, potentially targeted, attacks using unexpected attack vectors, such as malicious ad campaigns. 

Key Points

  • Targets Meta Business Accounts This report is a breakdown of a very complex phishing campaign that spoofs Meta using violations of standards and copyright infringement to steal business accounts. 
  • Efficient Targeting of 19 Countries The tools uncovered in this campaign can generate emails that target 19 different countries with suitable languages.  
  • Successfully Reaches Inboxes Cofense has identified a high number of these emails in enterprise environments that are protected by secure email gateways (SEGs). 
  • Uncover Threat Actor InfrastructureCofense discovered access to tools used by the threat actors sending emails for this campaign. The infrastructure includes tools for generating phishing emails, creating Netlify App links, checking if links are live, a large IOC list, and even information regarding targets and financial profits.  
     
  • Multi-Factor Authentication Bypass Threat actors using this phishing kit want full access to the Meta Business Accounts; in this campaign, they have included an additional step to bypass MFA.
     
  • Meta is the 2nd Most Spoofed Brand in Credential PhishingBased on credential phishing emails that Cofense has seen in 2024, Meta ranks second amongst the top spoofed brands. This is still significantly lower than Microsoft, the top brand spoofed in Credential Phishing.

Your Advertising Content Violated Policies 

The campaign starts with a phishing email like the one in Figure 1 below. Each email spoofs a Meta entity, in this case, it’s the Facebook Ads Team regarding a policy violation that requests that the user verify their information. At first glance, the sender’s address appears to be from the Facebook Ads Team, but there are still clear signs that this is phishing. A few examples would be grammatical errors like the bold “WHAT I CAN DO?”, the sender’s address, and of course a closer look at the link embedded into the “Verify” button that the email wants the user to click. By hovering the verify button, a user can quickly determine the following link to be malicious: 

“hxxps://restriction-case-278191641-545214[.]netlify[.]app/form[.]html” 

Figure 1: Phishing email that reached a user’s inbox.

Figure 1: Phishing email that reached a user’s inbox. 

Every email exhibits slight variations, yet they all adhere to the same theme. Table 1 presented below offers only a limited selection of subjects identified by Cofense for this campaign; however, numerous others exist. 

Table 1: Sample of subjects used in phishing emails spoofing Meta, specific to this campaign. 

Meta Spoofing Phishing Email Subjects
Your advertising content has violated our Policies
Advertising accounts will be deleted due to policy violations
Account disabled due to policy violations
Urgent Action Required: Notice of Deletion of Your Facebook Page
Your ad account is at risk of permanent restriction

The campaign starts with an email and ends with the account being compromised, but there are a few notable steps throughout the infection chain before the target business account is fully compromised. Each step follows the same lure to draw victims in and collect sensitive information related to the account. Images of the phishing pages can be seen in Figure 2 below. 

  • Email Link – The phishing emails start with a link that is either hyperlinked to text or embedded into a clickable image like the “Verify” button seen earlier. These links are all hosted on the domains Netlify[.]app or Vercel[.]app, which are web hosting services that the threat actors are abusing to host their phishing sites. In some cases, the campaign incorporates a t[.]co, X’s link shortener, into the infection chain that just acts as an additional redirect. 
     
  • Step 1: Landing Page – Following the email, users are met with a landing page that serves no functional purpose other than to manipulate users into believing this is a legitimate process to recover their account. 
     
  • Step 2: Account Information – The second step harvests Meta account information such as business email, page name, page owner, email address, phone number, information related to financial information, and recent travel arrangements, and an area to submit an appeal. Some of this information may seem unnecessary, but in the case of the threat actors successfully gaining access to an account, this could help them disrupt Meta’s account recovery process. 
     
  • Step 3: Account Password – The third step is pretty straightforward, it just requests that the user enter their password. Stolen information in this campaign is exfiltrated to various locations set up by the threat actors, one example is that credentials have been posted to a Telegram bot. 
     
  • MFA Bypass Step – This step is what makes this campaign such a high-level and potentially successful threat. It’s relatively simple at first glance, it just requests that the user inputs their 6-digit or 8-digit code from their authenticator app. Once entered, there is a loading process that essentially waits long enough for a new code to be generated and then requests it again. This additional step is likely used to ensure that access to the account has successfully been stolen. 

Figure 2: The landing page, the first page that users will see after interacting with the phishing URL.

Figure 2: The landing page, the first page that users will see after interacting with the phishing URL. 

Figure 3: Breakdown of the full phishing infection chain.

Figure 3: Breakdown of the full phishing infection chain. 

A Deep Analysis of Threat Actor Infrastructure 

During an analysis, a Cofense threat analyst identified open access to tooling used for this campaign hosted on bot1[.]sieulike[.]com. The site contains several redirects that have been translated from Vietnamese to English. These redirects go to areas the threat actors frequently visit like Netlify[.]app to create new links, Microsoft email login for Hotmail, and two spreadsheets; one for profits and costs in addition to one containing data on countries they target. Most of these are locked behind logins and require access to be granted by the threat actors. 

In particular, the Profit / cost spreadsheet requires a login to be able to access the spreadsheet. The fact that there is a spreadsheet specifically for costs and profits implies that the threat actors are seeking financial gain. While that is obvious for most campaigns, for this one, in particular, it certainly proves that the threat actors will employ an additional attack vector once the business ad account has been compromised. 

Figure 4: Threat actor resources, infrastructure, and tools used in this campaign.

Figure 4: Threat actor resources, infrastructure, and tools used in this campaign. 

The site also hosts several tools that show how efficient and advanced these threat actors are. These tools vary from simply converting input text into a CSV to generating complete phishing emails. A breakdown of some of the more notable tools that are listed in Figure 4: 

  • Check Links (Figures 5 and 6) – All of the indicators of compromise you could ever want are conveniently included in this tool. Not only does it contain a long list of phishing URLs that are actively being used, but it also allows the threat actors to automatically check if the links are still live or have been taken down.  
     
  • TEXT emails to countries (Figure 7) – This is a unique tool used to automatically generate phishing emails based on criteria entered by the threat actors. The threat actors select one of the 19 different countries they target, the theme they want the email to be (policy violation or copywriting infringement), the phishing link they want to use, and then it generates a text version of the email and the headers. 

Figure 5: Threat actor tool to input malicious links to check if they’re active.

Figure 5: Threat actor tool to input malicious links to check if they’re active. 

Figure 6: Results from the URL input showing if active or dead.

Figure 6: Results from the URL input showing if active or dead. 

Figure 7: Threat actor tool to generate phishing emails for this campaign.

Figure 7: Threat actor tool to generate phishing emails for this campaign. 

Meta Spoofing in the Threat Landscape

Cofense reports on a significant amount of credential phishing emails every day that were uncovered inside of an enterprise user’s inbox. Of those emails, Meta is the second most spoofed brand seen in the first quarter of 2024. Out of the campaigns spoofing Meta, emails from this campaign make up a good portion of the volume. Figure 8 below shows the top 5 brands spoofed in Credential Phishing campaigns seen by Cofense in Q1 of this year. Meta follows behind Microsoft, which is well-known for being spoofed in a high percentage of phishing emails due to the popular use of Microsoft email services. 

Figure 8: Top brands spoofed in Credential Phishing campaigns seen by Cofense in Q1 2024.

Figure 8: Top brands spoofed in Credential Phishing campaigns seen by Cofense in Q1 2024. 

The post Unmasking a Cyber Attack that Targets Meta Business Accounts appeared first on Cofense.

Leave a Reply

Your email address will not be published. Required fields are marked *

Explore More

A.I. Alone is Not Enough to Thwart Phishing Attacks

At Cofense, we have been active in testing, validating, and deploying general AI tools for the last three years – and we have learned a lot. How these tools integrate

New MaaS InfoStealer Malware Campaign Targeting Oil & Gas Sector

By Dylan Duncan Cofense Intelligence is tracking an advanced campaign that is successfully reaching intended targets in the Oil and Gas industry. The campaign delivers an uncommon, but advanced, Malware-as-a-Service

New Malware Campaign Targeting Spanish Language Victims

Cofense recently identified and named a new malware called Poco RAT, which is a simple Remote Access Trojan that targets Spanish language victims. It was first observed in early 2024,