A cybersecurity firm has flagged a rampant Facebook Messenger scam that infects whole networks.
The scheme has been active since September 2021 and relies on a fake login portal.
“We uncovered a campaign whose scale has potentially impacted hundreds of millions of Facebook users,” PIXM, the cybersecurity firm that flagged the scam, wrote in a blog.
The scam relies on a fake Facebook log-in portal where unsuspecting users enter their username and password.
After users are misled into turning over their data, they are redirected to a page littered with ads and surveys.
Based on correspondence between a hacker and PIXM, organizers of the scam make about $150 for every thousand page views and they’ve tricked their way into almost 400,000,000 page views – at this pace, the scam would have created about $60million in revenue.
PIXM advises that the hacker is likely boasting and overestimating the value of their take.
The scam achieved huge scalability because when one user was infected it would spread through Messenger.
The hackers would log in to the account and direct message other people in a user’s network.
“A user’s account would be compromised and, in a likely automated fashion, the threat actor would log in to that account and send out the link to the user’s friends via Facebook Messenger,” PIXM wrote.
Schemers masked their activities on Facebook Messenger servers by legitimizing part of their scam page’s URL.
Facebook would have been unable to allow users to click out to genuine pages if the URL alterations were detected and patched.
PIXM said this method of URL masking has “yielded enormous success” for hackers.
Facebook has long struggled to keep the lid on scams, data breaches and enforce a reasonable code of conduct.
Source: the-sun
