Phishing in Facebook's Pond

Phishing in Facebook's PondA scam targeting Facebook users duped hundreds of thousands of people out of their money and information, according to researchers at vpnMentor. The researchers discovered an exposed Elasticsearch database the scammers were using to store information taken via phishing attacks.

This information included:

  • “Facebook login credentials (usernames and passwords) for between 150,000 to 200,000 accounts on Facebook.
  • “Text outlines for comments the fraudsters would make on Facebook hosts, via a hacked account, directing people to suspicious and fraudulent websites.
  • “Personally Identifiable Information (PII) data such as emails, names, and phone numbers from 100,000s of people who’d registered at a fraudulent Bitcoin site also run by the fraudsters.
  • “Domains for the websites used in the scam.
  • “Technical information about how the fraudsters had automated their processes.”

All of this information was stolen in just four months, between June and September of 2020. It’s worth emphasizing that since the scammers misconfigured their database, this information was publicly available to anyone who stumbled across it, not just the scammers who stole it in the first place. One cannot expect sound cyber hygiene, after all, from the underworld.

The researchers also describe how the scam worked. The first stage of the scheme used spoofed Facebook login pages telling people they could find out who viewed their profile if they entered their credentials. Once they clicked “Log In,” their credentials would be sent to the scammers and stored in the database, while the victims would be redirected to a fake Facebook app in the Google Play store. (It’s not clear if this app itself was malicious or if it was just a decoy to prevent the victims from realizing they’d been phished.

Next, the scammers would log in to the victims’ Facebook accounts and comment links to Bitcoin scams on their friends’ posts. These links led to websites that directed people to deposit nearly $300 (€250) in order to begin trading.

New-school security awareness training can help your employees recognize the signs of a scam, even if it’s sent to them by a trusted contact.

vpnMentor has the story.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before the bad guys do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Topics: Phishing

Subscribe To Our Blog

Ransomware Hostage Rescue Manual

Get the latest about social engineering

Subscribe to CyberheistNews