Facebook credentials targeted in new phishing attack

Threat actors have launched a new phishing campaign aimed at exfiltrating Facebook credentials, reports ZDNet. Attackers have been sending phishing emails purporting to be from "The Facebook Team" warning recipients that their account may be disabled and removed due to violating other users' rights, according to a report from Abnormal Security. Recipients of the email are being lured into clicking a link that redirects to a Facebook post, which in turn contains another link redirecting to another website where they may send their appeal. Researchers noted that users have been asked to provide their names, email addresses, Facebook passwords, and other data for the fraudulent appeals process. Information collected through the fake appeals form could then be leveraged for accessing and locking Facebook accounts, as well as compromise other websites and apps using the same email address and password as their Facebook account. The sense of urgency brought by the emails has made such phishing attacks a success, researchers said. "This is often enough to convince recipients to provide their personal information, particularly if they are using their Facebook account for business purposes," said Abnormal Security Threat Intelligence Analyst Rachelle Chouinard.