Phishing in Facebook's Pond

A scam targeting Facebook users duped hundreds of thousands of people out of their money and information, according to researchers at vpnMentor. The researchers discovered an exposed Elasticsearch database the scammers were using to store information taken via phishing attacks.

This information included:

• “Facebook login credentials (usernames and passwords) for between 150,000 to 200,000 accounts on Facebook.
• “Text outlines for comments the fraudsters would make on Facebook hosts, via a hacked account, directing people to suspicious and fraudulent websites.
• “Personally Identifiable Information (PII) data such as emails, names, and phone numbers from 100,000s of people who’d registered at a fraudulent Bitcoin site also run by the fraudsters.
• “Domains for the websites used in the scam.
• “Technical information about how the fraudsters had automated their processes.”

All of this information was stolen in just four months, between June and September of 2020. It’s worth emphasizing that since the scammers misconfigured their database, this information was publicly available to anyone who stumbled across it, not just the scammers who stole it in the first place. One cannot expect sound cyber hygiene, after all, from the underworld.

The researchers also describe how the scam worked. The first stage of the scheme used spoofed Facebook login pages telling people they could find out who viewed their profile if they entered their credentials. Once they clicked “Log In,” their credentials would be sent to the scammers and stored in the database, while the victims would be redirected to a fake Facebook app in the Google Play store. (It’s not clear if this app itself was malicious or if it was just a decoy to prevent the victims from realizing they’d been phished.

Next, the scammers would log in to the victims’ Facebook accounts and comment links to Bitcoin scams on their friends’ posts. These links led to websites that directed people to deposit nearly $300 (€250) in order to begin trading.

New-school security awareness training can help your employees recognize the signs of a scam, even if it’s sent to them by a trusted contact.

vpnMentor has the story.