A new phishing campaign dubbed “Meta-Phish” has been identified by Trustwave researchers utilizing Facebook posts in its attack chain. This tactic is used to trick victims into providing personally identifiable information (PII), account credentials, and Facebook profile links to the actor responsible after receiving a phishing email disguised as a corporate violation notification. The email claims that access to the victim’s account will be lost if no objection is made within forty-eight (48) hours of receiving the notice. The email contains a link to a webpage that looks legitimate and uses a “Page Support” profile to show the fraudulent post. The user is then prompted to make an appeal through a crafted phishing page that mimics the actual Facebook copyright appeal page. Researchers noted that the three observed domains all appeared to be online as of December 15, 2022. The fields present in the phishing page include full name, login email address, phone number, Facebook page name, and additional info. Upon submission, the campaign also captures the victim’s IP address and geolocation information. All collected information is exfiltrated to the actor’s Telegram account. The victim is then redirected to an additional phishing page that displays a fake six (6) digit one-time-password request with a timer. Any combination of numbers will result in an error, and if the resulting “Need another way to authenticate?” or “Get Code” options are clicked, the victim is redirected to the legitimate Facebook website that requires them to log in. Researchers emphasized that there are currently various unauthentic accounts on the platform that are utilized in social engineering campaigns and threat actors will continue to innovate to bypass security controls and filters on social media platforms. CTIX analysts will continue to monitor phishing campaigns utilizing social media, and indicators of compromise (IOCs) for the Meta-Phish campaign can be viewed in Trustwave’s report linked below.