Network Security
Vulnerability Management
Privileged Access Management
Endpoint Security
Threat Hunting
Unified Endpoint Management
Email & Collaboration Security
Contents:
Yesterday, Meta, formerly known as Facebook, confirmed that it had pressed charges against cybercriminals who targeted its users with phishing scams on Facebook, Messenger, Instagram, and WhatsApp.
The Phishing Campaign
The scammers responsible for these phishing operations used roughly 39,000 phishing pages that would mimic the four platforms’ login pages.
The phishing scams were meant to trick people into sharing their login credentials on the fake login pages for popular platforms.
Jessica Romero, Meta’s Director of Platform Enforcement and Litigation declared:
This phishing scheme involved the creation of more than 39,000 websites impersonating the login pages of Facebook, Messenger, Instagram, and WhatsApp. On these websites, people were prompted to enter their usernames and passwords, which Defendants collected.
As part of the attacks, threat actors utilized a relay service to reroute internet traffic to phishing sites, hiding their attack infrastructure. This action allowed them to hide the actual location of the phishing pages, as well as the identities of their web hosting providers and the defendants.
When the number of attacks increased in March 2021, Facebook immediately started collaborating with the relay service used by the phishing operation to eliminate thousands of URLs used in the campaign.
We proactively block and report instances of abuse to the hosting and security community, domain name registrars, privacy/proxy services, and others. And Meta blocks and shares phishing URLs so other platforms can also block them.
Meta Took Legal Action Against Cybercriminals Before
This action is the latest in a series of lawsuits filed by the popular platform against cybercriminals who target its users and other malicious actors who use Facebook for malicious reasons.
According to BleepingComputer, in March 2020, Facebook sued domain name registrar Namecheap and its Whoisguard proxy service “for registering domain names that aim to deceive people by pretending to be affiliated with Facebook apps,” which were regularly used “for phishing, fraud, and scams.”
Meta also sued domain registrar OnlineNIC and its ID Shield privacy service in October 2019 for enabling the registration of copycat domains utilized in fraudulent operations.
Last week, Meta published a report named “Threat Report on the Surveillance-for-Hire Industry”, where it announced that it banned six alleged entities and a Chinese law enforcement supplier that provided services on surveillance-for-hire targeting 50 K people.
If you liked this article, follow us on LinkedIn, Twitter, Facebook, Youtube, and Instagram for more cybersecurity news and topics.
As a Senior Content Writer and Video Content Creator specializing in cybersecurity, I leverage digital media to unravel and clarify complex cybersecurity concepts and emerging trends. With my extensive knowledge in the field, I create content that engages a diverse audience, from cybersecurity novices to experienced experts. My approach is to create a nexus of understanding, taking technical security topics and transforming them into accessible, relatable knowledge for anyone interested in strengthening their security posture.
