A phishing campaign used fake Meta/Instagram business account suspension emails to trick users into providing credentials through fake chat support and detailed instructions, ultimately hijacking business accounts by adding attackers as secure login methods.
The Cofense Phishing Defense Center discovered a sophisticated phishing campaign targeting Meta Business accounts, particularly Instagram users. The campaign begins with fake emails claiming advertising restrictions and account suspension due to policy violations, appearing to come from Instagram support but actually originating from Salesforce addresses. Victims clicking 'Check more Details' are redirected to fraudulent pages on domains like businesshelp-manager.com that closely mimic legitimate Meta Business pages. The attackers employ two primary methods: a fake chat support system that requests business account screenshots and personal information, and detailed step-by-step guides for adding Two-Factor Authentication. Both methods ultimately trick users into adding the attacker's authenticator app named 'SYSTEM CHECK' as a secure login method, giving threat actors persistent access to hijacked business accounts. The campaign demonstrates high attention to detail with convincing emails, landing pages, live chat support, and even video instructions to maximize deception effectiveness.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to gain a personal advantage over others such as through cheating, fraud, scams, blackmail or targeted manipulation of beliefs or behavior. Examples include AI-facilitated plagiarism for research or education, impersonating a trusted or fake individual for illegitimate financial benefit, or creating humiliating or sexual imagery.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
No population impact data reported.