This Facebook Messenger phishing scam may have trapped millions of users

(Image credit: wk1003mike / Shutterstock )

A major phishing campaign has been uncovered that may have earned its operators millions of dollars through affiliate advertising commissions. 

Discovered by AI-focused cybersecurity firm PIXM in September 2021, before its peak in April and May 2022, the campaign leveraged Facebook’s Messenger service, legitimate URL shortener services, and web pages with adverts and surveys.

The premise is simple: the crooks created numerous phishing sites where victims would be lured into giving away their Facebook credentials. After that, two things would happen. One - they would be redirected to a website with ads, surveys, and other means of revenue generation for the operators, and two - the victims’ Facebook accounts would be used to further spread the campaign, via Messenger. 

Share your thoughts on Cybersecurity and get a free copy of the Hacker's Manual 2022end of this survey

Share your thoughts on Cybersecurity and get a free copy of the Hacker's Manual 2022. Help us find how businesses are preparing for the post-Covid world and the implications of these activities on their cybersecurity plans. Enter your email at the end of this survey to get the bookazine, worth $10.99/£10.99.

Circumventing Facebook's protections

Messenger is usually relatively good at spotting and killing phishing links, but the crooks managed to bypass the defense mechanism with legitimate URL shortening services such as,,, and, the researchers found.

The entire campaign, it would seem, was automated, with very little interference from the campaign’s masterminds. 

"A user's account would be compromised and, in a likely automated fashion, the threat actor would log in to that account and send out the link to the user's friends via Facebook Messenger," PIXM said.

Digging deeper, PIXM found one of the phishing pages hosting a link to a public, open, traffic monitoring app. Through the app, they discovered that in 2021, 2.7 million users visited one of the phishing sites, spiking up to 8.5 million this year. 

A total of 405 unique usernames were used as campaign identifiers, which is probably not the total number of accounts used for the campaign.

PIXM also found a common code snippet on all of the phishing pages, which referenced a website seized, and shut down, by law enforcement agencies. Allegedly, it belongs to a Colombian man, one Rafael Dorado, against whom an investigation is currently ongoing.

Details on the earnings are scarce, but the researchers are saying they’re “in the millions”.

Via: BleepingComputer

Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.