Two weeks ago, a co-worker received a message in Facebook Messenger from his friend. Based on the message, it seemed that the sender was telling the recipient that he was part of a video in order to lure him into clicking it.
Facebook Messenger message and the corresponding Facebook Page
The shortened link was initially redirecting to Youtube.com, but was later on changed to redirect to yet another shortened link – po.st:
Changes in the Picsee short link
The po.st shortened link supported two types of redirection links – original link and smart links. If the device that accessed the URL was running in iOS or Android, it was redirected to the utm.io shortened link, otherwise it was redirected to smarturl.it.
The short link with the smart links
So for the iOS and Android users, they were served with the following phishing page:
Phishing page for utm.io short link
For the rest of the devices, the users ended up with the smarturl.it link that went through several redirections which eventually led to contenidoviral.net. That page contained an ad-affiliate URL which redirected to mobusi.com, a mobile advertising company.
Phishing page’s ad-affiliate URL
Based on the data from the links, the campaign began last October 15th when it targeted mostly Swedish users. On the 17th, it moved to targeting Finnish users. Then from 19th onwards, it mostly went after German users.
The total number of clicks for the entire campaign reached almost 200,000, where close to 80% of the visitors were from Germany, Sweden and Finland.
Statistics from po.st tracking page
The campaign ran for two weeks with a main motive of stealing Facebook credentials from iOS and Android users. The cybercriminals used those stolen credentials to spread the malicious links, and subsequently gather more credentials. However, while in the process of stealing the credentials, the cybercriminals also attempted to earn from other non-iOS and non-Android users through ad-fraud.
This practice of using email addresses in place of unique names as account credentials creates a big opportunity for phishers. Just by launching this Facebook phishing campaign, they can mass harvest email and password credentials that are later on used for secondary attacks such as gaining access to other systems or services that could have a bigger monetary value because of password reuse.
We highly recommend the affected users to change their passwords as soon as possible, including other systems and services where the same compromised password was used.
URLs:
- hxxp://lnk[.]pics/19S3Y
- hxxp://lnk[.]pics/18JDK
- hxxp://lnk[.]pics/196OV
- hxxp://lnk[.]pics/18XH7
- hxxp://lnk[.]pics/196PN
- hxxp://lnk[.]pics/19LBP
- hxxp://lnk[.]pics/18YZV
- hxxp://lnk[.]pics/18QZW
- hxxp://lnk[.]pics/196PA
- hxxp://lnk[.]pics/19XK7
- hxxp://lnk[.]pics/18HFX
- hxxp://lnk[.]pics/19S3L
- hxxp://lnk[.]pics/18J7S
- hxxp://lnk[.]pics/19XKF
- hxxp://lnk[.]pics/19K94
- hxxp://lnk[.]pics/19LBW
- hxxp://pics[.]ee/188g7
- hxxp://pics[.]ee/18cdl
- hxxp://po[.]st/ORyChA
- hxxp://smarturl[.]it/02xuof
- hxxp://utm[.]io/290459
- hxxp://at.contenidoviral[.]net
Tagged: facebook, Kyb3r, mobusi, Phishing
Article Link: https://labsblog.f-secure.com/2017/10/30/facebook-phishing-targeted-ios-and-android-users-from-germany-sweden-and-finland/