Phishers Abuse Meta’s Business Partner Service to Steal Account Credentials

Summary

Huntress details a phishing campaign that abused Meta’s business partner email service, evolving to use a Messenger chatbot and steal account credentials, MFA codes, contact details, and ID documents. Meta has blocked the technique, and attacks have subsided.

Key points

The attackers used Meta’s legitimate business partner service to send phishing emails that appeared to come from a Meta address, embedding a URL in the purported partner’s name.
An earlier variant directed targets through sites.google[.]com/view/profile1012 to a fake Meta Agency Partner Program page hosted on aussiecleaningservices[.]com.
A June variant sent targets to a fraudulent Facebook Messenger chatbot, which directed them to phishing pages on sw[.]run and businesshelpcenterpageid563252.netlify[.]app.
The pages collected Meta credentials, TOTP MFA codes, business and personal contact details, and uploaded identity documents; submissions were sent to a Telegram bot.
Huntress says Meta added detections for URLs in business or owner names and blocked the technique; the observed attacks have subsided.

Article Details

Attack Vectors: Abused Meta’s business-partner email mechanism to send phishing lures from a legitimate Meta email address, embedding a URL in the purported partner name.
Redirected targets from a Google Sites lure or a Facebook Messenger chatbot to phishing pages impersonating Meta programs.
Collected Meta credentials, TOTP MFA codes, contact details, and identity documents through the phishing pages, then sent submissions to a Telegram bot channel.
Defensive Notes: Meta reportedly added detections for URLs embedded in business or business-owner names and restricted bogus accounts from initiating partnership requests.
Check the actual destination domain before following unexpected business invitations; legitimate-looking sender origins do not establish that a message is safe.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`api[.]goautolink[.]com`	Domain used by the earlier phishing variant to receive stolen victim data.
DOMAIN	`aussiecleaningservices[.]com`	Phishing landing-page domain posing as a Meta Agency Partner Program page.
DOMAIN	`sw[.]run`	Attacker-controlled domain used to frame Netlify-hosted phishing pages.
HOSTNAME	`businesshelpcenterpageid563252[.]netlify[.]app`	Netlify-hosted phishing page used in the content-monetization variant to collect credentials, MFA codes, and identity documents.