AccountDumpling Phishing Campaign Reportedly Targets 30,000 Facebook Accounts
Summary
Guardio says the Vietnamese-linked AccountDumpling operation abuses Google AppSheet emails and varied phishing lures to steal Facebook credentials, 2FA codes and ID photos; associated Telegram channels held about 30,000 victim records.
Key points
- Guardio named the operation AccountDumpling and estimates roughly 30,000 Facebook accounts were affected.
- Phishing emails posing as Meta Support target Facebook Business users and use Google AppSheet addresses as a delivery relay.
- Lures include account appeals, blue-badge checks, copyright complaints, verification PDFs and fake job offers.
- Pages hosted on Netlify and Vercel, along with Google Drive PDFs, collect credentials and other personal or business information.
- Some lures collect 2FA codes and government ID photos; data from the first three campaign clusters was found in associated Telegram channels.
- PDF metadata and open-source research were cited as evidence linking the operation to a Vietnamese individual and a digital-marketing website.
Article Details
- Event Type
- Phishing campaign and Facebook account takeover operation
- Impact
- Guardio estimated that roughly 30,000 Facebook accounts were compromised. The campaign collected credentials, two-factor authentication codes, government-issued ID photos, and other victim data, which was sent to Telegram channels; the stolen accounts were reportedly sold through an illicit storefront.
MITRE ATT&CK
People
Vendors
GoogleA newly discovered Vietnamese-linked operation codenamed AccountDumpling is using Google AppSheet as a phishing relay to send deceptive Meta Support emails that harvest Facebook credentials for resale.MetaA newly discovered Vietnamese-linked operation codenamed AccountDumpling is using Google AppSheet as a phishing relay to send deceptive Meta Support emails that harvest Facebook credentials for resale.
Products
CanvaThe campaigns employ multiple lures and hosting platforms (Netlify, Vercel, Google Drive, Canva) to collect passwords, 2FA codes, ID photos and other data which are exfiltrated to Telegram channels, impacting roughlyFacebookA newly discovered Vietnamese-linked operation codenamed AccountDumpling is using Google AppSheet as a phishing relay to send deceptive Meta Support emails that harvest Facebook credentials for resale.Google AppSheetA newly discovered Vietnamese-linked operation codenamed AccountDumpling is using Google AppSheet as a phishing relay to send deceptive Meta Support emails that harvest Facebook credentials for resale.Google DriveThe campaigns employ multiple lures and hosting platforms (Netlify, Vercel, Google Drive, Canva) to collect passwords, 2FA codes, ID photos and other data which are exfiltrated to Telegram channels, impacting roughlyNetlifyThe campaigns employ multiple lures and hosting platforms (Netlify, Vercel, Google Drive, Canva) to collect passwords, 2FA codes, ID photos and other data which are exfiltrated to Telegram channels, impacting roughlyTelegramGoogle Drive, Canva) to collect passwords, 2FA codes, ID photos and other data which are exfiltrated to Telegram channels, impacting roughly 30,000 Facebook accounts worldwide.VercelThe campaigns employ multiple lures and hosting platforms (Netlify, Vercel, Google Drive, Canva) to collect passwords, 2FA codes, ID photos and other data which are exfiltrated to Telegram channels, impacting roughly
Countries
Australiavictim records, most of whom are located in the U.S., Italy, Canada, the Philippines, India, Spain, Australia, the U.K., Brazil, and Mexico, and have been locked out of their own accounts.Brazilmost of whom are located in the U.S., Italy, Canada, the Philippines, India, Spain, Australia, the U.K., Brazil, and Mexico, and have been locked out of their own accounts.Canadahave been found to hold about 30,000 victim records, most of whom are located in the U.S., Italy, Canada, the Philippines, India, Spain, Australia, the U.K., Brazil, and Mexico, and have been locked out ofIndiahold about 30,000 victim records, most of whom are located in the U.S., Italy, Canada, the Philippines, India, Spain, Australia, the U.K., Brazil, and Mexico, and have been locked out of their own accounts.Italythree clusters have been found to hold about 30,000 victim records, most of whom are located in the U.S., Italy, Canada, the Philippines, India, Spain, Australia, the U.K., Brazil, and Mexico, and have been locked outMexicoare located in the U.S., Italy, Canada, the Philippines, India, Spain, Australia, the U.K., Brazil, and Mexico, and have been locked out of their own accounts.Philippinesfound to hold about 30,000 victim records, most of whom are located in the U.S., Italy, Canada, the Philippines, India, Spain, Australia, the U.K., Brazil, and Mexico, and have been locked out of their own accounts.Spainabout 30,000 victim records, most of whom are located in the U.S., Italy, Canada, the Philippines, India, Spain, Australia, the U.K., Brazil, and Mexico, and have been locked out of their own accounts.United Statesfirst three clusters have been found to hold about 30,000 victim records, most of whom are located in the U.S., Italy, Canada, the Philippines, India, Spain, Australia, the U.K., Brazil, and Mexico, and have been