A brand new phishing campaign leveraging chatbot software (opens in new tab) on Messenger has been uncovered by cybersecurity firm SpiderLabs.
The goal of the campaign is to obtain people’s Facebook credentials and various other personal information, the researchers explained.
At first, the victim receives an email, pretending to be from Facebook, claiming that their page is in violation of the site’s community standards and will be terminated in 48 hours.
The email also carries an “Appeal Now” link, which gives the victim a chance to appeal the termination.
Red flags galore
Thankfully, the content of the email contains a few red flags that should help users identify the message as fraudulent.
For example, there are a few spelling and grammar mistakes in the body of the message, and the recipient’s name appears as “Policy Issues”, which is not how Facebook handles such cases.
Should the victim still press the “Appeal Now” link, they are then taken to a Messenger chatbot, where they are prompted to click through to another “Appeal Now” link. This is most likely done to circumvent any email security services, as the link to the chatbot is not malicious in itself.
Here, the researchers found more red flags: the page that owns the chatbot has a handle @case932571902, which is most definitely not Facebook’s. It’s also empty, having zero followers and zero posts.
If the victim proceeds, they are taken to a website hosted on Google Firebase. This one is disguised as a Facebook “Support Inbox”, and this is where the victim ends up giving away sensitive data to the attackers.
According to the researchers, the attackers are asking for email addresses, mobile numbers, first and last names, page names and, obviously, passwords (opens in new tab).
“Chatbots serve a huge purpose in digital marketing and live support, so it is no wonder that cyber attackers are now abusing this feature. People are not inclined to be suspicious of its contents, especially if it comes from a seemingly genuine source,” the report states.
“The fact that the spammers are leveraging the platform that they are mimicking makes this campaign a perfect social engineering technique. As always, we advise everyone to remain vigilant when surfing the web and to not interact with unsolicited emails.”
