Facebook Phishing Campaign

Introduction

An investigation into a suspicious Facebook Messenger message led to the identification of an active Facebook phishing campaign seemingly resulting in victim accounts being abused by the threat actor to further propagate the phishing lure.

Masquerading as a link to a YouTube video sent from a contact known to the recipient, those that click on the nefarious link are, unbeknownst to them, redirected through multiple websites that first determine if the victim is using a mobile device, presumably as the attack will be less noticeable, before presenting a Facebook phishing page and, after multiple redirects, culminating in the presentation of the legitimate Google Play Store site.

Other than the theft of Facebook credentials, seemingly abused to further the reach of this campaign, the motivations or final objectives of the threat actor remain somewhat vague.

Aside from the potential for some kind of referral-fraud, assuming that the redirection chain passed the victim through websites offering affiliate schemes, it appears unusual for a phishing campaign to not culminate in the victim being returned to the targeted site.

Whilst the phished credentials appear to be used to further propagate the threat, it is not clear if any other data theft or account fraud is occurring within Facebook, especially given that the ‘noise’ generated by sending unsolicited messages to multiple contacts would likely alert the victim to the malicious activity and allow them to secure their accounts soon after compromise.

That being said, a webpage statistics service used by the threat actor provides an indication of the scale of this incident with, as of 1700hrs UTC on 16 October 2020, some 450 thousand page views being recorded.

As such, the impact of this incident appears somewhat severe and therefore our initial findings were promptly shared with Facebook in addition to both Bit.ly and StackPath whose servers were being abused within the redirection chain.

Notably, all three organizations should be commended for their prompt response, taking down offending content and hosts to halt the propagation of this threat that and protect countless other Facebook users.

Analysis

Initial Lure

Commencing with the delivery of a localized lure message via Facebook Messenger from a known contact (Figure 1), a link masquerading as a YouTube video is accompanied with text suggesting that the video “looks like” the recipient and therefore encourages them to view the content.

Figure 1 – Initial Facebook Messenger lures (Hebrew, Greek & English examples)

These lures appear take advantage of Facebook’s Open Graph protocol that allows HTML content with meta and property attributes to manipulate what is displayed in the URL preview. As such, the use of og:title has been set to a localized version of “it look[s] like you” whilst og:image displays the YouTube logo to add a sense of legitimacy to the message. The use of these meta tags were also observed within the redirection chain, potentially providing entry points for other campaigns or targeted platforms (Figure 2).

Figure 2 – Example Open Graph Meta Tags

Mobile Device Check

Should the Facebook Messenger recipient be lured into clicking on the fake video link, they are redirected to an initial website outside of Facebook that , in addition to having Open Graph metadata itself, loads a JavaScript that checks the screen width of the victim (Figure 3).

Figure 3 – Determining the victim device based on screen width

Should the screen width be less than 720 pixels, the victim is redirected to the next stage, otherwise the string ‘bobo’ is logged to the console, an action invisible to a standard user, and no further action taken.

Phishing Page

Seemingly in preparation for the phishing page, the victim is redirected to a cloud storage bucket with a new object (“Keys”) seemingly being generated for each visit. Content delivered from this bucket once again includes HTML content with Open Graph metadata (Figure 4) and, via an obfuscated JavaScript, displays the Facebook phishing page.

Figure 4 – Redirection to the Facebook phishing page

To deliver a single resource to the victim, the obfuscated JavaScript contains base64-encoded image files and mimics a login page that would be consistent with Facebook when viewed on an Android device (Figure 5).

Figure 5 – Facebook phishing page (Note the Android messaging)

Notably at this point, a legitimate third-party tracking service, ‘Whos.Amung.Us’, is loaded and based on their unique identifier, zb6325, their ‘dashboard’ can be accessed to determine the scale of the campaign (Figure 6).

Figure 6 – Potential victim volume (16 October 2020, hourly view)

As can be observed from these statistics, notifying StackPath of the abuse on their platform enabled them to take down the offending cloud storage bucket which resulted in the number of potential victims dropping.

Whilst there are periods of lower activity, likely due to the time zones of those targeted, accessing the ‘views’ section of this dashboard (Figure 7) provides a staggering indication of the number of Facebook users potentially clicking through this campaign with some 245 thousand sessions and 463 thousand page views.

Figure 7 – Recorded pageviews and sessions associated with the campaign

Although it is not possible to determine if these pageviews and sessions resulting in Facebook credentials being phished, the volume of potential victims will undoubtedly result in a significant return for the threat actor.

Those falling for the phishing page and entering their Facebook credentials will find their email address and password being sent via a HTTP POST request in the appropriately named form values email and pass to yet another host, hxxps://secure.sshmobile-as[.]net/iframe.php.

Interestingly, and presumably as an attempt to evade analysis, the obfuscated JavaScript used at this stage appears to attempt to identify if the browser’s development tools are being used (devtools.isOpen) although this could be bypassed and the code both reviewed and deobfuscated.

Redirection Chain

Having submitted content to the phishing form, be that valid or not, a Bit.ly short link URL was used to redirect the victim to another nefarious domain, potentially allowing the threat actor to gather additional campaign statistics and/or to allow them to reconfigure this stage of the redirection chain without needing to update already deployed JavaScript payloads.

In yet another campaign disruption and takedown effort, Bit.ly were notified of our findings and swiftly acted to remove both the offending short link, replacing it with a warning message, and deactivating the associated account.

Those that were redirected prior to this action would have momentarily seen a ‘loading’ screen (Figure 8) before being redirected yet again to suspicious intermediate websites before arriving at the final destination, the legitimate ‘Google Play’ store.

Figure 8 – Post-phish ‘Loading’ screen

Whilst the true intention of having victims pass through these intermediate websites (Figure 9) cannot be fully determined, visiting them outside of the redirection chain appears to result in potentially pay-per-click revenue generating content being displayed.

Figure 9 – Redirection chain

Victims finally reaching their unintended final destination, albeit confusingly Google Play rather than a YouTube video consistent with the initial lure, would then, assuming they submitted valid credentials, find their Facebook accounts potentially accessed and abused to further propagate the campaign.

In addition to notifying both StackPath and Bit.ly of the abuse on their services, resulting in swift takedown actions that disrupted this particular campaign, Facebook were also quick to act on our tipoff and remove offending content to protect their users.

How Was the Attack Stopped?

By proactively reaching out to the relevant parties, we were able to disrupt and mitigate the attack:

1. Facebook – Having notified Facebook of the active campaign and ongoing threat to their users, they responded with the immediate removal of all abusing content, fake pages and links, before proceeding to contact Amazon Web Services (AWS) to continue the mitigation process on their infrastructure.
2. Bit.ly – A swift response enabled the removal of a short link, and the associated account, providing one of the major redirects, killing any potential revenue generation process.
3. StackPath – Prompt removal of the S3 storage bucket used, along with any associated account, prevented Facebook users from being phished and forced the threat actors to migrate to a different environment and mutate their campaign, disrupting the ongoing attack for around one hour whilst other measures were taken.
4. CERT IL – Given the high number of Israeli victims, an apparent focus in the campaign analyzed, CERT IL were informed so that they could potentially assist in any additional takedown efforts.

Motive

Although those behind this campaign acquired full Facebook account access, abusing new victims to further propagate the malicious link to their contacts via Facebook Messenger, no account takeover activity was observed in a ‘honeypot’ account used during this investigation.

Based on the multiple redirections involved, and the method of distributing the initial lure, it appears that the primary motive for this campaign was to perform some form of click or referral fraud and, therefore, we surmise that the threat actor is exclusively focused on financial gains.

Seemingly by setting up numerous fake pages, likely using automated methods given the consistency in naming, campaigns of this nature may start by delivering some initial lures before the operation grows organically.

Recommendations

As much as Facebook is considered a safe platform, with automated security tools such as link scanning, the ability to share links and content is both the platform’s strong point and weakness. This is especially true when nefarious parties can craft appealing lures by abusing the Open Graph protocol to manipulate URL previews with their own metadata and effectively hide malicious links from users by masquerading as legitimate content.

As such, we would recommend that users of Facebook, and other social media platforms, consider the following:

• Employ multi-factor authentication wherever available, such as on Facebook and other social media platforms, to thwart account takeover attempts.
• Exercise caution whenever visiting content that takes you outside of Facebook and, even if a nefarious link is clicked, remember that it is still possible to close the browser before submitting your credentials.
• Look for visual clues in any random, unusual or unsolicited links received from known contacts or other entities. If you are unsure, ask your contact for confirmation before opening.
• In the event of any unusual behavior, such as messages being sent from your account without your permission, contact Facebook’s Safety and Security teams via the links within the platform and make use of the ‘Sign Out’ feature to disconnect any rogue access.

Statistics

For reference, the following statistics were obtained from the legitimate tracking service during the incident.

Top Abused Browsers & Devices

Affected Countries

Operating Systems

Total Views

Indicators of Compromise

Facebook Pages

The following Facebook pages, since taken down, appear to be related to the delivery of unsolicited messages in recent months and as such, any content originating from them, or similarly structured names, should be ignored:

• Adrinna-Vimeo-for-you-130288-107180347629768
• Aleika-vedeo-8595959559-107037671087164
• Alexandra-video-98568-107385590993157
• Aleyshita-vedeo-515844949-103675128091694
• Andreina-vedeo-574184549-101372408341340
• Angelica-vedeo-293q10291-100821485064752
• Ashely-veodep-595945698596-111273803985868
• Ashleyy-veodeo-4984659574-100739625049616
• Bree-vedeo-65629595959-101642138313791
• Breikyna-vedeo-5995559-100644918414968
• Chantal-vedeo-5996595-105983567869982
• Deisy-vedeo-59794949494-104922874639468
• Eugenia-YouTube-for-you-120335-108888814054452
• Faith-Vimeo-for-you-120352-103004511327129
• Jett-Vimeo-for-you-120368-100333764934356
• Leisha-vedeo-5485488949-105984114525903
• Leiska-vedeo-26952695959-104025734739171
• Leslie-vedeo-54598484488-572819923388869
• Leslie-vedeo-5484515-106856231109238
• Lesliesas-vedeo-48288812-112594720543247
• Lesliess-vedeo-595494486-105125567959075
• Liliana-vedeo-959741-113664763745072
• Lilianita-vedeo-56489949-106699901142758
• Lilianita-vedeo-59418448-103459061455705
• Lixia-veodep-5963595895-108688030914240
• Liz-vedeo-5198958959-104117634716593
• Lydoa-veoodeo-5648865497-114530880322095
• Marica-vidoe-652955946562-106555761126389
• Maricpica-vedeo-59844848-110551367416694
• Mentro55-106779974141376
• Merisandbes-vedeo-1518548-107906887687552
• Merisnad-vedeo-48877794-101883861616855
• Morena-Vimeo-for-you-130145-111270667162879
• Muchachita-vedeo-5695945-101855514952628
• Natalie-vedeo-4484484484-587428558607603
• Nicol-vedeo-62959952-101141238349494
• Nuria-veodep-7849895985-115107290275681
• Paloma-Vimeo-for-you-120385-107767390844475
• Perez-vedeo-4159748952-111691237283335
• Perez-veodep-946418748-106593334458594
• Pereza-vedeo-45956295-102545014882953
• Sheyla-vedeo-592123121-108145560987174
• Shiloh-Vimeo-for-you-120361-106785327610164
• Valme-YouTube-for-you-120312-107943967441211
• Zaray-Vimeo-for-you-120360-109153294037408

URLs

• hxxps://zsqijfvmaz[.]easy[.]co/?tznm=%2Fevsdvsdvsdvs%2Fhzb81IAW8Z49JSwLru[.]html&fbclid=<ID>
• hxxps://americafrelance[.]com/js/aws[.]js
• hxxps://medic2[.]s3[.]us-east-2[.]stackpathstorage[.]com/munchachitalinda[.]html (Legitimate; Taken down)
• hxxps://content1[.]sshmobile-as[.]net/html/?content=running
• hxxps://whos[.]amung[.]us/pingjs/?k=zb6325&t=spotify (Legitimate)
• hxxps://secure[.]sshmobile-as[.]net/iframe[.]php
• hxxps://bit[.]ly/3lCdila (Legitimate; Taken down)
• hxxps://grand-prizeshere[.]life/?u=<U>&o=<O>
• hxxps://grand-prizeshere[.]life/media/mainstream/pixel[.]html
• hxxps://severalourred6[.]live/1461542062/?u=<U>&o=<O>&f=1&sid=<ID>&fp=<FP>
• hxxps://severalourred6[.]live/web/?sid=wyw3attzak1oyqlups5kfxpj
• hxxps://mobile-global-apps-storages[.]life/?url=<URL>
• hxxps://mobile-global-apps-storages[.]life/away[.]php
• hxxps://play[.]google[.]com/store/apps (Legitimate)

Potentially Associated Cloud Storage

• 2000-days-pre-kindergarten-calgary[.]s3[.]ca-central-1[.]amazonaws[.]com
• assets-service[.]s3[.]ca-central-1[.]amazonaws[.]com
• asvacsavcs[.]s3[.]ca-central-1[.]amazonaws[.]com
• burkenewsletter[.]s3[.]ca-central-1[.]amazonaws[.]com
• canvadocs-prod-yul-assets[.]s3[.]ca-central-1[.]amazonaws[.]com
• covid-qc[.]s3[.]ca-central-1[.]amazonaws[.]com
• cydeferepo[.]s3[.]ca-central-1[.]amazonaws[.]com
• healthpro-production[.]s3[.]ca-central-1[.]amazonaws[.]com
• instructure-uploads-yul[.]s3[.]ca-central-1[.]amazonaws[.]com
• llluuuunnnndddiiiiiii[.]s3[.]ca-central-1[.]amazonaws[.]com
• maclins[.]s3[.]ca-central-1[.]amazonaws[.]com
• marketing-delivery-publishing[.]s3[.]ca-central-1[.]amazonaws[.]com
• mynewsmakers[.]s3[.]ca-central-1[.]amazonaws[.]com
• notorious-prod-yul[.]s3[.]ca-central-1[.]amazonaws[.]com
• opzauyzsfds[.]s3[.]ca-central-1[.]amazonaws[.]com
• quincy-network[.]s3[.]ca-central-1[.]amazonaws[.]com
• r3l3az3[.]s3[.]ca-central-1[.]amazonaws[.]com
• rosog[.]s3[.]ca-central-1[.]amazonaws[.]com
• tgamriker[.]s3[.]ca-central-1[.]amazonaws[.]com
• vcchr-5[.]s3[.]ca-central-1[.]amazonaws[.]com
• videowallpaper[.]s3[.]ca-central-1[.]amazonaws[.]com
• voicenote[.]s3[.]ca-central-1[.]amazonaws[.]com
• www[.]safraempresas[.]s3[.]ca-central-1[.]amazonaws[.]com

File Hashes

• A0AF25F0F4C030D3A5B00C0FCCFFF13F9BCE3A12848B9EC428320D22299A4FCE
• 94CC3866B729AC4324629DCC94FA1EFB9305B3B2818C2937791A66742489B6C9
• 8FD279F1FAECABB6B31D2CECFE41F9A28A3B43DB46891DD9B242DF8E88731846
• F7F90FA443C5CC78F2012936FB5E4ADD5F832599D70451B8671AAE4C4EEC8F37
• 5AC13F13AFC917D022FF31F441EFF6252912E1AE5BCF4202CEEEC84EB86C67FB
• 7BC2A33FED589688DDECC31781B0567C335C10A2B27E4392726D37F997F5D8C1
• 094701970AC27536238C570EF269D2131B7B0F195E2A488C4AC13C370680BF16

Contact us to learn more on phishing detection & remediation by Argos™ Digital Risk Protection Platform