{"id":22455,"date":"2023-07-12T16:10:04","date_gmt":"2023-07-13T00:10:04","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2023\/07\/12\/news-16185\/"},"modified":"2023-07-12T16:10:04","modified_gmt":"2023-07-13T00:10:04","slug":"news-16185","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2023\/07\/12\/news-16185\/","title":{"rendered":"Criminals target businesses with malicious extension for Meta’s Ads Manager and accidentally leak stolen accounts"},"content":{"rendered":"

Like all social media platforms, Facebook constantly has to deal with fake accounts, scams and malware. We have written about scams targeting consumers that redirect to fake Microsoft alert pages<\/a>, but there are also threats targeting businesses that use Facebook to promote their products and services.<\/p>\n

In the past few weeks, there’s been a resurgence in sponsored posts and accounts that impersonate Meta\/Facebook’s own Ads Manager. Crooks are promising better advertising via optimization, and increased performance when you use their (malware-laden) software. Meta has tracked and analyzed<\/a> several threat actors such as DuckTail<\/a> that have been active for a number of years with a particular interest for Facebook advertising accounts.<\/p>\n

Now, we’ve discovered a new attack that uses malicious Chrome extensions to steal Facebook account credentials and is not related to the DuckTail malware. While tracking this campaign, we noticed the threat actors made a mistake when they packaged one of the malware files with their own stolen data.<\/p>\n

We have passed the information about this campaign and the threat actors to Meta and thank it for taking prompt action following our reporting.<\/p>\n

Key takeaways<\/h2>\n