The National Cyber Security Centre of Finland (NCSC-FI) warns about an ongoing phishing campaign that attempts to compromise Facebook accounts by impersonating the victims' friends in Facebook Messenger chats.
See also: Microsoft: Multi-stage phishing campaign exploits Azure AD
In the notice, NCSC-FI states that all Facebook users who received messages from online acquaintances asking for their phone numbers and a verification code delivered via SMS are the targets of this ongoing scam.
If they provide the requested information, the attackers will take control of their accounts by changing the password and associated email.
After the scam, Facebook accounts will target other possible victims from their friends list in similar scams.
See also: Google Drive: Warns about suspicious files used for phishing/malware
To successfully compromise their targets' Facebook accounts, the scammers will follow these steps:
- Initially they send a message from the compromised friend's account via Facebook Messenger.
- They request the target's phone number, saying they want to help with signing up for an online contest that promises prizes worth thousands of euros.
- The next stage involves a request for a code that is sent via SMS, allegedly sent by the contest organizers to confirm participation.
- If the SMS verification code is shared with the scammers, they will use it together with the phone number to gain access and steal the victim's Facebook account.
- They will then change the password and email address and start promoting similar scams to the victims' friends.
Meta (formerly known as Facebook) recently filed a federal lawsuit in a California court to block other ongoing phishing attacks targeting Facebook, Messenger, Instagram , and WhatsApp.
The threat actors behind these phishing campaigns have used approximately 40,000 phishing pages designed to mimic the login pages of the four platforms.
See also: WordPress plugin: Flaw exposes users of 20,000 sites to phishing
These actions constitute part of a long series of lawsuits that Facebook has filed against attackers who target its users and abuse its platform for malicious purposes.
Information source: bleepingcomputer.com
