A fake Facebook landing page was used by an attacker to steal one million Facebook login credentials over a period of just four months.
According to anti-phishing firm PIXM, the fake Facebook login portal was used to trick unsuspecting users into entering their account details to steal their data.
The fake landing page was modified from Facebook’s legitimate URL, and the fake portal code also contained a link to a traffic monitoring application that allowed the anti-phishing company to view the tracking metrics.
“People often underestimate the value of their social media accounts, failing to enable MFA and otherwise protect their accounts from cybercriminals. Unfortunately, when bad actors take over an account, it is often used to attack their own friends and family. Through the use of a real account that has been compromised, bad actors use the trust inherent in a known connection to trick people into taking actions or risks they normally would not,” said Erich Kron, security awareness advocate at KnowBe4.
To protect against this flaw, users are advised to avoid clicking on links that appear to be fake or illegitimate. They are also advised to use multi-factor authentication.
The sources for this piece include an article in TechRepublic.
