Ankura CTIX FLASH Update - December 16, 2022

Ransomware/Malware Activity

New Meta-Phish Campaign Utilizing Facebook Copyright Violation Lures

A new phishing campaign dubbed "Meta-Phish" has been identified by Trustwave researchers utilizing Facebook posts in its attack chain. This tactic is used to trick victims into providing personally identifiable information (PII), account credentials, and Facebook profile links to the actor responsible after receiving a phishing email disguised as a corporate violation notification. The email claims that access to the victim's account will be lost if no objection is made within forty-eight (48) hours of receiving the notice. The email contains a link to a webpage that looks legitimate and uses a "Page Support" profile to show the fraudulent post. The user is then prompted to make an appeal through a crafted phishing page that mimics the actual Facebook copyright appeal page. Researchers noted that the three observed domains all appeared to be online as of December 15,