Attackers Pose as Facebook Support Using Legitimate Facebook Posts to Bypass Security Solutions
Impersonating Facebook using its own platform against them, a new phishing attack takes advantage of victim’s inability to distinguish legitimate from illegitimate.
This new phishing attack is both simple and brilliant at the same time. Security researchers at Trustwave have identified a Facebook-themed phishing attack that starts with an email posing as Facebook Support claiming a copyright violation.
(Note the poorly-written email and the completely wrong email address; should be red flags from the start!)
The Facebook link within the email is legitimate – it takes victims to an actual page on Facebook titled “Page Support” where the copyright infringement is further confirmed, and an appeal form is offered:
The use of “meta” in the appeal form’s URL is all that’s needed to trick victims into thinking it, too, is legitimate. Victims are taken to this “appeal” form where they are asked to give up their Facebook credentials (you knew it was coming, right?).
Trustwave has uncovered a large number of these kinds of attacks that use a legitimate Facebook page made to look like it’s an official page designed to help the victim through their issues (be it copyright infringement, account recovery, avoiding account suspension, etc.).
There are plenty of obvious flaws with this attack, but in the hurried response to address something like an account suspension, often victims overlook the obvious and focus on the path to fix their unknowingly fictitious “problem”. This is why users within organizations need to be proactively trained to spot these through continual Security Awareness Training designed to not just educate them on broad cyberthreat topics, but by exposing them to real-world campaigns so they know what a phishing attack looks like.
Don’t get hacked by social media phishing attacks!
Many of your users are active on Facebook, LinkedIn, and Twitter. Cybercriminals use these platforms to scrape profile information of your users and organization to create targeted spear phishing campaigns in an attempt to hijack accounts, damage your organization’s reputation, or gain access to your network.
KnowBe4’s Social Media Phishing Test is a complimentary IT security tool that helps you identify which users in your organization are vulnerable to these types of phishing attacks that could put your users and organization at risk.
Here’s how the Social Media Phishing Test works:
- Immediately start your test with your choice of three social media phishing templates
- Choose the corresponding landing page your users see after they click
- Show users which red flags they missed or send them to a fake login page
- Get a PDF emailed to you in 24 hours with your percentage of clicks and data entered
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/social-media-phishing-test-partner?partnerid=001a000001lWEoJAAW