Facebook is one of the most widely used social media even today, and having a blue tick (a verified badge) on the platform is still a dream for many. While the Meta platform offers various methods via which you can get your hands on a verified badge, a new campaign is rapidly getting popular that allows users to get the blue tick for free. Security researchers have warned that thousands of users have already been affected by a campaign. The scheme is designed to look convincing and uses trusted platforms to deliver its messages. Moreover, at the first glance, it is harder for people to spot the danger. Experts have already said that the attack is a part of a larger effort to target accounts that hold financial or business value, including pages run by creators, companies, and advertisers.
The campaign has been identified by researchers at Guard.io and is known as AccountDumpling. According to researcher Shaked Chen, more than 30,000 accounts may already have been compromised. The attackers are believed to be linked to a Vietnam-based group that focuses on hijacking social media accounts and reselling them later.
Also read: Moto Buds 2 Plus launches with Sound by Bose, up to 55dB ANC in India: Price and availability
One of the key tactics involves sending emails through legitimate systems rather than fake domains. In this situation, attackers used the Google AppSheet platform, which is normally meant for automation, in the wrong way. They used its notification feature to send phishing emails. These emails look real and trustworthy because they are sent through a reliable service.
Attackers deploy various techniques in order to lure their targets. This may involve threatening victims about deactivating their accounts due to policy breaches or copyright infringement concerns. In other cases, the emails will tempt recipients to verify their accounts by offering them a verification badge for free without requiring subscriptions at Meta. Once the link is clicked by the victims, attackers take them through a number of fake procedures, such as passing the CAPTCHA test and logging into their accounts, thus providing login details and a two-factor authentication code.
The research shows that attackers utilised some advanced techniques to bypass security mechanisms. For example, attackers made use of invisible characters in the names of emails and modified texts in such a way that security algorithms would not detect them, but they were still readable by humans.
Also read: Got an NDMA emergency alert on your phone? Here is what it means
Experts have advised the users to stay cautious and avoid clicking on suspicious links. Furthermore, they have also cautioned the users to only rely on the official channels for account updates.