Phishers target 5K Facebook advertisers with fake biz pages

More than 5,000 businesses that use Facebook for advertising were bombarded by tens of thousands of phishing emails in a credential- and data-stealing campaign. Check Point researchers say that they spotted about 40,000 phishing emails sent to their customers across the US, Europe, Canada, and Australia - and they were sent from the legitimate facebookmail.com domain. While most organizations received fewer than 300 messages, one company alone was hit with more than 4,200. In an emailed response to The Register’s questions, Check Point’s research team said that they don’t know how many people clicked on the phishing emails or who is behind the phishing attacks. “The attackers’ technique appears to involve registering new domains and using them for only a few days (up to a week), which makes attribution and tracking difficult,” the researchers said, adding that the campaign is ongoing with a daily average of about 2,350 emails sent per day. Because this number only represents detections across the vendor’s customer base, however, “the actual number of emails distributed is likely higher.” To pull off this phishing expedition, the criminals created shell Facebook Business pages representing businesses that don't exist, and then used the Business invitation feature to send phishing emails that look like the real deal. This makes the fake notifications look more convincing because they appear to come directly from Meta, plus the legit domain helps the phishing emails bypass secur...