According to TheRegister.com, more than 5,000 businesses using Facebook for advertising were targeted by approximately 40,000 phishing emails sent from the legitimate facebookmail.com domain. Check Point researchers discovered the campaign hitting companies across the US, Europe, Canada, and Australia, with one organization alone receiving over 4,200 messages. The attackers created fake Facebook Business pages representing nonexistent companies, then used Facebook’s Business invitation feature to send convincing phishing notifications. The emails contained urgent language like “account verification required” and redirected victims to credential-stealing websites. Targeted industries included automotive, education, real estate, hospitality, and finance, with both small businesses and some large, well-known companies affected.
Why this phishing campaign is so effective
Here’s the thing about this attack – it’s brilliantly simple yet devastatingly effective. The criminals aren’t using some shady domain that security filters would flag. They’re using Facebook’s actual infrastructure against itself. When an email comes from facebookmail.com, it passes all the technical checks that normally catch phishing attempts. And because these are actual Business Suite notifications, they look exactly like the legitimate messages these employees see every day.
Think about it – if you’re managing Facebook ads for your company, you’re probably getting legitimate notifications from this exact domain constantly. Your brain is trained to trust these messages. Add some urgent language about account verification, and you’ve got a perfect storm for credential theft. The researchers nailed it when they said these sectors are “ideal targets” because their employees are conditioned to trust Meta notifications.
The bigger security problem
This isn’t just another phishing campaign – it represents a fundamental shift in how attackers operate. They’re weaponizing legitimate services that we all trust. Facebook’s infrastructure becomes the delivery mechanism. The very features designed to help businesses grow become tools for stealing from them.
And let’s be real – how many smaller businesses have sophisticated security training for their social media managers? These are often marketing people, not IT security experts. They’re focused on engagement metrics and ad performance, not spotting sophisticated phishing attempts that look exactly like the real thing.
The scale here is concerning too. 40,000 emails might sound like a spray-and-pray approach, but when they’re this targeted and credible, even a low success rate can compromise hundreds of business accounts. We don’t know how many credentials were actually stolen, but given the sophistication, I’d bet the success rate was higher than your average phishing attempt.
What businesses need to do now
Look, if your company uses Facebook for advertising, you need to have a conversation with your team today. This isn’t about blaming employees for clicking links – it’s about recognizing that the threats have evolved beyond obvious scams. These emails look 100% legitimate because technically, they are legitimate notifications, just from fake business pages.
Basic security awareness training needs to evolve beyond “don’t click suspicious links.” When the links come from facebookmail.com and look exactly like the notifications you receive daily, that advice becomes useless. Companies need to implement additional verification steps, especially for anything involving account access or financial information.
And here’s a thought – maybe it’s time for Meta to reconsider how their Business invitation system works. When criminals can create fake business pages and automatically send thousands of legitimate-looking notifications through Facebook’s own systems, that’s a platform problem, not just a user education problem. The fact that Meta hasn’t immediately responded to inquiries about this campaign isn’t exactly reassuring.
Basically, this campaign should serve as a wake-up call that the old rules of phishing detection no longer apply. When attackers can weaponize legitimate services this effectively, everyone needs to up their game. Check Point’s full analysis shows just how sophisticated these attacks have become, and honestly, it’s probably just the beginning of this trend.
Your article helped me a lot, is there any more related content? Thanks!
Thank you for your sharing. I am worried that I lack creative ideas. It is your article that makes me full of hope. Thank you. But, I have a question, can you help me?
Hiya very nice website!! Guy .. Beautiful .. Superb .. I will bookmark your site and take the feeds additionally? I am satisfied to search out so many helpful info right here in the submit, we want work out extra strategies in this regard, thanks for sharing. . . . . .
May I just say what a comfort to find an individual who really knows what they’re talking about on the net. You definitely know how to bring a problem to light and make it important. More people should look at this and understand this side of the story. I can’t believe you’re not more popular because you surely possess the gift.
May I just say what a comfort to uncover somebody that really knows what they are discussing on the internet. You certainly realize how to bring an issue to light and make it important. More and more people must check this out and understand this side of your story. It’s surprising you are not more popular since you certainly have the gift.
Aw, this was a very nice post. Spending some time and actual effort to produce a very good article… but what can I say… I put things off a whole lot and don’t manage to get nearly anything done.
Wow that was unusual. I just wrote an extremely long comment but after I clicked submit my comment didn’t show up. Grrrr… well I’m not writing all that over again. Anyway, just wanted to say superb blog!
Excellent post. Keep posting such kind of information on your blog. Im really impressed by your blog.
Hello there, You’ve performed a fantastic job. I’ll definitely digg it and individually recommend to my friends. I’m sure they will be benefited from this web site.
Right now it seems like BlogEngine is the top blogging platform out there right now. (from what I’ve read) Is that what you’re using on your blog?
Greate article. Keep writing such kind of info on your page. Im really impressed by your site.
Currently it looks like Drupal is the best blogging platform available right now. (from what I’ve read) Is that what you’re using on your blog?
Hey I know this is off topic but I was wondering if you knew of any widgets I could add to my blog that automatically tweet my newest twitter updates. I’ve been looking for a plug-in like this for quite some time and was hoping maybe you would have some experience with something like this. Please let me know if you run into anything. I truly enjoy reading your blog and I look forward to your new updates.
Aw, this was an exceptionally good post. Taking the time and actual effort to create a really good article… but what can I say… I procrastinate a whole lot and don’t seem to get nearly anything done.
Right now it appears like BlogEngine is the preferred blogging platform out there right now. (from what I’ve read) Is that what you are using on your blog?
Currently it looks like BlogEngine is the preferred blogging platform out there right now. (from what I’ve read) Is that what you are using on your blog?
Wow that was unusual. I just wrote an very long comment but after I clicked submit my comment didn’t show up. Grrrr… well I’m not writing all that over again. Anyhow, just wanted to say fantastic blog!
Wow that was odd. I just wrote an incredibly long comment but after I clicked submit my comment didn’t show up. Grrrr… well I’m not writing all that over again. Regardless, just wanted to say excellent blog!
At this time it sounds like Drupal is the top blogging platform available right now. (from what I’ve read) Is that what you are using on your blog?
Right now it looks like Drupal is the preferred blogging platform available right now. (from what I’ve read) Is that what you are using on your blog?
Currently it looks like Movable Type is the preferred blogging platform out there right now. (from what I’ve read) Is that what you’re using on your blog?
Currently it sounds like Movable Type is the best blogging platform out there right now. (from what I’ve read) Is that what you are using on your blog?
Hey I know this is off topic but I was wondering if you knew of any widgets I could add to my blog that automatically tweet my newest twitter updates. I’ve been looking for a plug-in like this for quite some time and was hoping maybe you would have some experience with something like this. Please let me know if you run into anything. I truly enjoy reading your blog and I look forward to your new updates.
May I simply just say what a relief to uncover someone who really knows what they are talking about on the internet. You certainly realize how to bring a problem to light and make it important. More and more people ought to look at this and understand this side of your story. I was surprised that you aren’t more popular since you definitely possess the gift.
Aw, this was an incredibly nice post. Taking a few minutes and actual effort to produce a great article… but what can I say… I put things off a lot and never manage to get anything done.
Can I simply say what a comfort to find somebody that really understands what they’re discussing on the internet. You definitely know how to bring an issue to light and make it important. More and more people have to look at this and understand this side of the story. I was surprised you are not more popular since you surely possess the gift.
Right now it looks like Expression Engine is the top blogging platform out there right now. (from what I’ve read) Is that what you’re using on your blog?
Currently it sounds like BlogEngine is the top blogging platform out there right now. (from what I’ve read) Is that what you’re using on your blog?
Hi there, You’ve performed a fantastic job. I will certainly digg it and in my opinion suggest to my friends. I am sure they’ll be benefited from this website.
Aw, this was a really nice post. Finding the time and actual effort to create a good article… but what can I say… I hesitate a lot and don’t seem to get anything done.
Right now it appears like Expression Engine is the top blogging platform out there right now. (from what I’ve read) Is that what you are using on your blog?
At this time it looks like Expression Engine is the preferred blogging platform available right now. (from what I’ve read) Is that what you’re using on your blog?
I was able to find good advice from your articles.
Right now it seems like Expression Engine is the preferred blogging platform out there right now. (from what I’ve read) Is that what you are using on your blog?
Hey I know this is off topic but I was wondering if you knew of any widgets I could add to my blog that automatically tweet my newest twitter updates. I’ve been looking for a plug-in like this for quite some time and was hoping maybe you would have some experience with something like this. Please let me know if you run into anything. I truly enjoy reading your blog and I look forward to your new updates.
Excellent article. Keep posting such kind of info on your page. Im really impressed by your site.
Right now it seems like Drupal is the preferred blogging platform out there right now. (from what I’ve read) Is that what you’re using on your blog?
Hey I know this is off topic but I was wondering if you knew of any widgets I could add to my blog that automatically tweet my newest twitter updates. I’ve been looking for a plug-in like this for quite some time and was hoping maybe you would have some experience with something like this. Please let me know if you run into anything. I truly enjoy reading your blog and I look forward to your new updates.
Greate article. Keep posting such kind of information on your blog. Im really impressed by your blog.
At this time it sounds like WordPress is the top blogging platform available right now. (from what I’ve read) Is that what you are using on your blog?
Hello there, You’ve done a great job. I’ll certainly digg it and individually recommend to my friends. I am sure they’ll be benefited from this website.
Excellent article. Keep posting such kind of information on your blog. Im really impressed by your site.
At this time it seems like WordPress is the best blogging platform out there right now. (from what I’ve read) Is that what you are using on your blog?
At this time it looks like Drupal is the top blogging platform available right now. (from what I’ve read) Is that what you’re using on your blog?
Wow that was unusual. I just wrote an incredibly long comment but after I clicked submit my comment didn’t show up. Grrrr… well I’m not writing all that over again. Regardless, just wanted to say superb blog!
May I just say what a comfort to discover someone that really knows what they are discussing online. You definitely understand how to bring a problem to light and make it important. A lot more people should check this out and understand this side of the story. It’s surprising you’re not more popular given that you certainly have the gift.
Right now it looks like Expression Engine is the preferred blogging platform out there right now. (from what I’ve read) Is that what you are using on your blog?
Wow that was unusual. I just wrote an incredibly long comment but after I clicked submit my comment didn’t appear. Grrrr… well I’m not writing all that over again. Anyway, just wanted to say excellent blog!
Excellent pieces. Keep writing such kind of information on your blog. Im really impressed by it.