Hackers Target Facebook Accounts in Latest Phishing Attack

A newly disclosed phishing campaign targets Facebook users by abusing the platform’s external URL warning feature to harvest login credentials. Attackers hide malicious destinations behind Facebook’s own domain via the “You’re about to leave Facebook” redirect, using the actual malicious URL as the u parameter in the redirect link and prompting users to press Continue to reach a counterfeit login portal.

Security researchers at Trustwave MailMarshal SpiderLabs uncovered emails that route victims through legitimate-looking Facebook warning pages before landing on attacker-controlled sites, with the initial click and the warning page both displaying facebook[.]com in the address bar to foster trust. The campaigns commonly impersonate Facebook account security alerts and use multilingual messages to broaden reach, while subject lines mimic genuine security notices and leverage branding to urge urgent action.

Mitigations include educating users about redirects, enabling multi-factor authentication for Facebook and email accounts, deploying email security gateways, and monitoring for spoofed messages and suspicious redirect patterns. End users are advised to report phishing attempts and keep browsers and anti-phishing extensions up to date to assist in detecting forged login pages. according to Trustwave MailMarshal SpiderLabs