Threats Tagged 'vietnamese threat actor'

Between November 2025 and June 2026, an unknown threat actor exploited Meta's Business Account Manager service to send phishing emails appearing to come from legitimate Meta addresses. The attackers abused the business partner mechanism by embedding URLs in the business name field, making phishing emails look authentic. The campaign advanced to use Facebook Messenger chatbots and exfiltrated stolen credentials, MFA codes, phone numbers, and identity documents to a private Telegram channel. The phishing pages impersonated Meta's Agency Partner Program and Verified badge services, targeting businesses to steal account credentials. Meta responded by implementing detection measures and blocking accounts attempting to use URLs in business names. Vietnamese language elements in the exfiltration process suggest a possible origin of the attackers. No affected software versions or CVEs are identified.