The list of affected users is growing at a rapid pace of more than a 100 entries per minute, according to ThreatNix, a Nepal-based cybersecurity firm.
The researchers first came across the phishing campaign through a sponsored
The page that posted the ad was using the profile picture and name of Nepal Telecom and was almost indistinguishable from the legitimate page.
"We saw similar
According to the firm, the ad phishing campaign is using localised Facebook posts and pages spoofing legitimate entities and targeted ads for specific countries.
Links within these posts then redirected to a static Github page website that contained a login panel for Facebook.
"All these static GitHub pages forwarded the phished credentials to two endpoints one to a Firestore database and another to a domain owned by the phishing group," the researchers noted.
"We discovered almost 500 GitHub repositories containing phishing pages that are a part of the same phishing campaign".
Facebook or GitHub was yet to comment on the ThreatNix report.
ThreatNix said that it is working on taking down the phishing infrastructure by collaborating with relevant authorities "as such we are withholding the information related to the domains until then".
While Facebook takes measures to make sure that such phishing pages are not approved for ads, in this case, the scammers were using Bitly link's which initially must have pointed to a benign page and once the ad was approved, was modified to point to the phishing domain, the researchers explained.
SEE ALSO:
Top stocks to watch — Tata Steel, Vedanta, Adani Green, Tata Motors, Maruti, M&M, DHFL, V-Mart, Indian Bank, and others
Upcoming smartphones in India in January 2021
Google is testing a shortcut feature for TikTok and Instagram videos