Vietnamese-linked threat actors, codenamed AccountDumpling, utilized Google AppSheet as a phishing relay to distribute emails impersonating Meta Support. These emails directed users to fake login pages designed to steal Facebook account credentials, 2FA codes, and personal data, resulting in the compromise of approximately 30,000 accounts.
Delivery
Meta Support Impersonation
confirmed
Threat actors sent phishing emails from 'noreply@appsheet.com' (Google AppSheet) impersonating Meta Support, using various lures like account deletion warnings to bypass spam filters.
Defender cut points
Implement robust email gateway filtering for suspicious sender domains and contentConduct regular user awareness training against phishing and social engineering tactics
