"Thought it was a genuine login window"... Beware of Facebook phishing tactics upgrading

Warnings have pointed out that phishing techniques targeting Facebook user accounts are becoming increasingly sophisticated. Cybersecurity firm Trellix revealed in a recent report that attackers are exploiting a browser-based disguise technology, known as the “browser within a browser” technique, which is designed to look exactly like the real login window.

This technology surpasses simple phishing emails or fake login pages; it can create a completely independent login pop-up within the user’s web browser. Since it appears to be the authentic Facebook URL, users find it difficult to detect that they are entering information into a fake login window. This has led to a sharp increase in account theft rates.

The starting point of such phishing activities is usually an email containing seemingly authoritative warning messages (such as copyright infringement or login anomaly detection). After clicking on a link disguised as an email from Meta or a law firm, users are guided to a carefully designed double login process. During this process, users first go through entering basic personal information such as name, email, phone number, and date of birth, before being asked to input their real Facebook password. Once attackers gain full access to the account using this information, they may further spread phishing messages or steal personal data for secondary crimes like identity theft.

Trellix pointed out that a notable aspect of this attack activity is that the fake login pages are no longer hosted on malicious domains but are instead deployed on cloud hosting platforms like Netlify or Vercel. This abuse of highly trusted cloud services, combined with URL shortening services, can easily bypass most email security filters or network filtering systems.

Trellix emphasizes that this increasingly sophisticated “browser within a browser” attack poses a serious threat because it is difficult to identify through traditional visual inspection alone. The company warns that even technically skilled users can be easily deceived and notes that relying solely on traditional security habits is no longer sufficient.

Therefore, the company strongly recommends all Facebook users enable two-factor authentication, avoid clicking links in received emails whenever possible, and when encountering issues, be sure to access Facebook by directly entering “facebook.com” in the browser or through the official mobile app.

As cutting-edge technology becomes more widespread, the era where user protection techniques need to become more sophisticated has arrived. It is more important than ever for security companies and IT platforms to establish a joint defense system capable of responding in real-time to the evolution of such phishing tactics.