{"id":6047,"date":"2024-10-31T16:09:33","date_gmt":"2024-10-31T21:09:33","guid":{"rendered":"https:\/\/www.darkreading.com\/cyberattacks-data-breaches\/facebook-businesses-targeted-infostealer-phishing-campaign"},"modified":"2024-10-31T16:09:33","modified_gmt":"2024-10-31T21:09:33","slug":"facebook-businesses-targeted-in-infostealer-phishing-campaign","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/10\/31\/facebook-businesses-targeted-in-infostealer-phishing-campaign\/","title":{"rendered":"Facebook Businesses Targeted in Infostealer Phishing Campaign"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

An unknown threat actor is targeting Facebook businesses and advertising account users in Taiwan through a phishing campaign, using decoy emails and fake PDF filenames.<\/span><\/p>\n

These dupes are designed to impersonate a company’s legal team and lure the victim in with its falsified details, convincing them to download and execute malware.<\/span><\/p>\n

In addition, the bad actors sent phishing emails from a well-known industrial motor manufacturer and a famous online store in Taiwan, claiming copyright infringement by the business.<\/span><\/p>\n

“The emails demand the removal of the infringing content within 24 hours, cessation of further use without written permission, and warn of potential legal action and compensation claims for non-compliance,” <\/span>said Cisco Talos researchers<\/a><\/span>, which observed the scams in action.<\/span><\/p>\n

They said the threat actors also use a variety of techniques and tools to evade antivirus detection and sandbox analysis, such as shellcode encryption, code obfuscation, and embedding LummaC2 and Rhadamanthys information stealers into legitimate binaries.<\/span><\/p>\n

Lumma Stealer<\/a><\/span> is a malware designed to exfiltrate information from compromised systems, targeting system details, Web browsers, and browser extensions, among other data.<\/span><\/p>\n

Rhadamanthys<\/a><\/span> is a sophisticated infostealer sold on underground forums that first emerged two years ago. It gathers system information, credentials, cryptocurrency wallets, passwords, cookies, and data from other applications. <\/span><\/p>\n

This phishing campaign has been ongoing since at least July; the initial vector of the campaign is a malware download link included in a phishing email using typical decoys in traditional Chinese, indicating that the target victims are Chinese speakers.<\/span><\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

An unknown threat actor is targeting Facebook businesses and advertising<\/p>\n","protected":false},"author":12,"featured_media":6048,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[809],"class_list":["post-6047","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-dark-reading"],"featured_image_urls":{"full":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/facebook-businesses-targeted-in-infostealer-phishing-campaign.jpg?fit=1809%2C1057&ssl=1",1809,1057,false],"thumbnail":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/facebook-businesses-targeted-in-infostealer-phishing-campaign.jpg?resize=150%2C150&ssl=1",150,150,true],"medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/facebook-businesses-targeted-in-infostealer-phishing-campaign.jpg?fit=300%2C175&ssl=1",300,175,true],"medium_large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/facebook-businesses-targeted-in-infostealer-phishing-campaign.jpg?fit=640%2C374&ssl=1",640,374,true],"large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/facebook-businesses-targeted-in-infostealer-phishing-campaign.jpg?fit=640%2C374&ssl=1",640,374,true],"1536x1536":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/facebook-businesses-targeted-in-infostealer-phishing-campaign.jpg?fit=1536%2C897&ssl=1",1536,897,true],"2048x2048":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/facebook-businesses-targeted-in-infostealer-phishing-campaign.jpg?fit=1809%2C1057&ssl=1",1809,1057,true],"chromenews-featured":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/facebook-businesses-targeted-in-infostealer-phishing-campaign.jpg?fit=1024%2C598&ssl=1",1024,598,true],"chromenews-large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/facebook-businesses-targeted-in-infostealer-phishing-campaign.jpg?resize=825%2C575&ssl=1",825,575,true],"chromenews-medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/facebook-businesses-targeted-in-infostealer-phishing-campaign.jpg?resize=590%2C410&ssl=1",590,410,true]},"author_info":{"display_name":"Dark Reading","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/darkreading\/"},"category_info":"Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","jetpack_featured_media_url":"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/10\/facebook-businesses-targeted-in-infostealer-phishing-campaign.jpg?fit=1809%2C1057&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/6047","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=6047"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/6047\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media\/6048"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=6047"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=6047"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=6047"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}