This campaign involved abuse of Meta's Business Account Manager service to send phishing emails from legitimate Meta addresses by manipulating the business partner mechanism, specifically embedding URLs in the business name field. This manipulation caused phishing emails to appear as authentic Meta communications. The threat actor evolved the campaign to include Facebook Messenger chatbots for interaction and exfiltrated sensitive data such as credentials, MFA codes, phone numbers, and identity documents to a private Telegram channel. The phishing pages impersonated official Meta services targeting businesses to capture account credentials. Meta mitigated the threat by detecting and blocking accounts that attempted to use URLs in business names. The presence of Vietnamese language elements in the exfiltration process suggests the attackers may be Vietnamese. There is no indication of a software vulnerability or patch; this is an abuse of legitimate service features.

The campaign resulted in credential theft, including multi-factor authentication codes, phone numbers, and identity documents, potentially enabling account takeover and identity fraud. The phishing emails originated from legitimate Meta addresses, increasing their credibility and likelihood of success. The use of Facebook Messenger chatbots and Telegram channels for exfiltration indicates a sophisticated and multi-channel attack. The impact is primarily on businesses targeted for credential compromise and identity theft. No direct software or service vulnerability exploitation is reported.

Meta has implemented detection mechanisms and blocked accounts attempting to use URLs in business names to prevent this abuse. Organizations should be aware of phishing attempts that appear to come from legitimate Meta addresses and verify communications independently. Since this is an abuse of service features rather than a software vulnerability, no patch is applicable. Users should remain vigilant against phishing and report suspicious Meta communications. Follow Meta's official guidance and updates for any further mitigation steps.