Impersonating Facebook using its own platform against them, a new phishing attack takes advantage of victim’s inability to distinguish legitimate from illegitimate.
This new phishing attack is both simple and brilliant at the same time. Security researchers at Trustwave have identified a Facebook-themed phishing attack that starts with an email posing as Facebook Support claiming a copyright violation.
(Note the poorly-written email and the completely wrong email address; should be red flags from the start!)
The Facebook link within the email is legitimate – it takes victims to an actual page on Facebook titled “Page Support” where the copyright infringement is further confirmed, and an appeal form is offered:
The use of “meta” in the appeal form’s URL is all that’s needed to trick victims into thinking it, too, is legitimate. Victims are taken to this “appeal” form where they are asked to give up their Facebook credentials (you knew it was coming, right?).
Trustwave has uncovered a large number of these kinds of attacks that use a legitimate Facebook page made to look like it’s an official page designed to help the victim through their issues (be it copyright infringement, account recovery, avoiding account suspension, etc.).
There are plenty of obvious flaws with this attack, but in the hurried response to address something like an account suspension, often victims overlook the obvious and focus on the path to fix their unknowingly fictitious “problem”. This is why users within organizations need to be proactively trained to spot these through continual Security Awareness Training designed to not just educate them on broad cyberthreat topics, but by exposing them to real-world campaigns so they know what a phishing attack looks like.
Here's how the Social Media Phishing Test works:
