Over 10 Million Facebook Users Hacked in Ongoing Phishing Scam | McAfee Blog

In this digital age, communicating online and through our devices has become the norm. From sharing highlights of last night’s game to sending cute animal videos back and forth, so much of our connectedness happens virtually. It’s become so easy to chat with friends and loved ones through social media that we don’t even have to think about it. We know who’s on the other end of the screen, so why would we worry? We know our friends would never send us a malicious link that would steal our information, so why be cautious? Right? 

Not necessarily. Though a message or link may seem like it’s coming from a friend, it’s also possible that it was sent without their knowledge. There are many ways for hackers to scam people very believably. The latest Facebook Messenger hack is just one of many examples. 

Facebook Frenemies 

According to PIXM, Facebook users have been conned for several months by a phishing scam that tricks them into handing over their account credentials. Users are shown a fake login page that copies Facebook’s user interface, giving it the illusion of being real. When someone enters their credentials, their password and login combo is sent to the hacker who then sends out the same link and fake login to the user’s friends through Facebook Messenger. Any user who clicks the link is asked to fill out their credentials, and the cycle repeats. PIXM estimates that over 10 million Facebook users have been duped by this scam since 2021. 

This hacker was able to utilize a technique to evade Facebook’s security checks. When a user clicks on the link in the Messenger app, the browser redirects to a legitimate app deployment service, then redirects again to the actual phishing pages with advertisements and surveys that accrue revenue for the hacker. Using this legitimate service link prevents Facebook from blocking it without blocking other legitimate apps and links as well. Researchers say that even if Facebook managed to block one of these links, several others are created with new unique IDs every day to replace it. 

Phishing scams like these are harder to detect due to the realistic-looking interface on the login pages and that these malicious links are seemingly coming from friends and family. However, there are always key things to look out for when faced with phishing scams. 

Swim Away From These Phishes 

Scams don’t always come from overtly sketchy emails or text messages from strangers. Sometimes they can (unintentionally) come from people we know personally. This isn’t to say that your friends online can’t be trusted! However, it’s important to always be cautious and keep an eye out for any odd behavior to stay on the safe side. Here are some key things to look out for when faced with potential malicious phishing scams: 

• Lack of personalization. These types of scams may be coming from online friends you don’t speak to often, if at all. If someone you rarely speak to is sending you links out of the blue, that’s an automatic red flag. But if you’re still unsure or if this is coming from someone you know well, pay close attention to the message, the greeting (if any), and whether it’s personalized or not. If it seems cold or overly general, avoid it!
• Links don’t look quite right. If you’re receiving a link through email, hover over the URL without clicking on it to see the link preview. If it looks suspicious, delete it altogether. For links being sent through social platforms, check to see if the URL matches the content in the message being sent to you or if there is a preview attached. If these things don’t match or aren’t present, it’s best to play it safe and stay away.
• Spelling and tone seem off. If the message you’re receiving is riddled with spelling or grammar mistakes, proceed with caution, especially if it’s unlike your friend to have those types of errors in their messages. In that same vein, if the tone of the message doesn’t match the typical vibe of the person you’re receiving it from, it’s best to ignore it and move on!
• The message is telling you to act. Always be wary of a strange message and link asking you to act. If the message is telling you to download something, don’t click any links or attachments. Simply delete the message and carry on!

When in doubt, just ask! If you’ve received a message and a link from a friend online, simply ask if they meant to send it to you. If they didn’t send it themselves, not only did you dodge a bullet, but your friend is also now aware that they’ve been hacked and can take the necessary precautions to ensure their information is protected. And if they did mean to send it to you, then you can click the link knowing that it’s safe to do so. It’s always best to err on the side of caution when it comes to your online security.