Live
- 2024 on track to be hottest year on record
- PM Modi’s visit to Solapur: Women applaud ‘Double-Engine’ government’s initiatives
- Nagarkurnool MLA Dr. Kuchukulla Rajesh Reddy Campaigning in Maharashtra Elections
- Wife Kills Husband with Her Lover: Details of Veldanda Murder Case Revealed by SP Gaikwad
- Strict Action on Violations of Food Rights: Telangana Food Commission Chairman Goli Srinivas Reddy
- Smooth Conduct of Group-3 Exams with Strict Security Measures: Collector Badavath Santosh
- Delhi HC orders cancellation of LOC issued against Ashneer Grover, wife
- Shami’s absence a major blow for India in BGT, says Paul Adams
- Will organize protests at borders if attack on minority Hindus in Bangladesh not stopped: Bengal LoP
- Dutch Ambassador Marisa Gerard Meets Telangana CM A. Revanth Reddy in Delhi
Mega ad phishing campaign hits over 6.15 lakh Facebook users
Mega ad phishing campaign hits over 6.15 lakh Facebook users
Cybersecurity researchers have unearthed a large-scale ad phishing campaign that has compromised accounts of more than 6.15 lakh Facebook
New Delhi: Cybersecurity researchers have unearthed a large-scale ad phishing campaign that has compromised accounts of more than 6.15 lakh Facebook users from at least 50 countries, by exploiting the pages of open source repository GitHub.
The list of affected users is growing at a rapid pace of more than 100 entries per minute, according to ThreatNix, a Nepal-based cybersecurity firm.
The researchers first came across the phishing campaign through a sponsored Facebook post that was offering 3GB mobile data from Nepal Telecom and redirecting to a phishing site hosted on GitHub pages.
The page that posted the ad was using the profile picture and name of Nepal Telecom and was almost indistinguishable from the legitimate page.
"We saw similar Facebook posts targeting Facebook users from Tunisia, Egypt, Philippines, Pakistan, Norway, Malaysia etc," the firm claimed in a statement this week.
According to the firm, the ad phishing campaign is using localised Facebook posts and pages spoofing legitimate entities and targeted ads for specific countries.
Links within these posts then redirected to a static Github page website that contained a login panel for Facebook.
"All these static GitHub pages forwarded the phished credentials to two endpoints one to a Firestore database and another to a domain owned by the phishing group," the researchers noted.
"We discovered almost 500 GitHub repositories containing phishing pages that are a part of the same phishing campaign".
Facebook or GitHub was yet to comment on the ThreatNix report.
ThreatNix said that it is working on taking down the phishing infrastructure by collaborating with relevant authorities "as such we are withholding the information related to the domains until then".
While Facebook takes measures to make sure that such phishing pages are not approved for ads, in this case, the scammers were using Bitly link's which initially must have pointed to a benign page and once the ad was approved, was modified to point to the phishing domain, the researchers explained.
