Meta Verified Scam Ads on Facebook Steal User Account Details

Meta Verified scam ads on Facebook are deception aimed at stealing user credentials by promising free verification badges. Security researchers say a new malvertising campaign targets Facebook users with malicious ads that claim to unlock Meta’s blue verification tick via a legitimate-looking browser extension, with instructional videos to persuade downloads.

According to Bitdefender, at least 37 malicious advertisements promote this fake tool, all coming from the same Facebook account, and the campaign bears hallmarks of Vietnamese-speaking threat actors. The malicious code includes adjustable variables for fake badge placement, and the extension collects session cookies and IP addresses, sending them to attacker-controlled Telegram bots, while some variants interact with Facebook Graph API using stolen tokens to target Business accounts.

The distribution uses Box[.]com to host malware and continuously refresh campaigns, enabling an industrialised cycle of cybercrime, including the sale of hijacked accounts on underground Telegram channels. The attackers exploit users’ desire for verification, and the article notes that Meta does not issue verification badges via browser extensions; users should download software only from official sources. 10 September 2025.