New Phishing Campaign Targets Meta Business Suite Users

Security researchers at Check Point have recently uncovered a large-scale phishing campaign that weaponises Facebook’s own Business Suite infrastructure to deliver convincing fraudulent notifications, according to Check Point. The campaign distributed over 40,000 phishing emails to more than 5,000 customers across the United States, Europe, Canada, and Australia, primarily targeting industries heavily reliant on Facebook advertising, including automotive, education, real estate, hospitality, and finance.

Threat actors create fake Facebook Business pages branded with authentic-looking Meta logos and names, then abuse the platform’s business invitation feature to distribute phishing emails that appear to originate from facebookmail[.]com, a legitimate Meta domain.

The emails mimic genuine notifications with urgent subject lines such as “Action Required: You’re Invited to Join the Free Advertising Credit Program” and “Account Verification Required,” directing victims to phishing websites hosted on domains like vercel[.]app. Telemetry indicates most affected organisations received fewer than 300 emails, while one company was bombarded with more than 4,200 messages, suggesting a template-driven mass campaign rather than spear-phishing. Organisations are urged to strengthen user training, deploy enhanced email security with behavioural analysis, and enforce multi-factor authentication.