The attack starts with an email that appears to come from a legitimate Facebook Business account. According to Huntress, which identified the campaign, the messages passed security validation checks in many inboxes precisely because they looked authentic at the sending-domain level. That means the message can land in your primary inbox rather than a spam folder. (Source: Infosecurity-Magazine)

The lure offers Meta For Business users a way to "protect their brand" with a verified badge. This works as social engineering because verification is a real Facebook feature.

Click through and you reach a fake login page controlled by the attackers. It asks you to sign in to "confirm your identity," including entering any multi-factor authentication (MFA) codes. Handing over an MFA token in real time lets the attackers complete the login themselves, defeating a control most businesses rely on to stop stolen-password reuse.

The campaign added a second layer through a chatbot run from a fraudulent Facebook Messenger account named AI Strategic Partner. Interacting with the bot pushed victims to another attacker-controlled phishing page that repeated the request for username, password, and a phony MFA check.

The final step asked for a photo of a passport, driver's license, or national ID card to "verify" the account. Uploading that document hands the attackers a large amount of personal information alongside the account credentials they already collected.

The combined data set feeds directly into the consequences that follow. With a working login, MFA bypassed, and government ID in hand, the attackers can take over a business account and use it for fraud, and they can use the stolen identity documents in scams that reach well beyond Facebook itself.

Attack Chain and Messenger Chatbot Mechanics

The attack unfolds in two coordinated tracks: an email-based phishing lure and a Facebook Messenger chatbot operated through a fraudulent account named AI Strategic Partner. Both paths funnel the victim toward the same goal — credential and identity theft — but the chatbot leg adds a layer of legitimacy that a static email cannot.

Once a target interacts with the bot, the conversation steers them to a phishing page controlled by the attackers. The page presents itself as a "verification" step for the business account, mirroring the layout and messaging tone of Meta's own account-management flows so the request feels routine rather than suspicious.

The chatbot works because it operates inside Messenger itself. A message arriving from what looks like a Facebook business contact does not trigger the same skepticism as an unsolicited email, and the interactive back-and-forth mimics the way legitimate Meta support prompts a user through a task. For a business account owner, this means the malicious request arrives inside a trusted channel you already use to manage your page.

Credential and Identity Harvesting

The phishing page repeats the credential-collection sequence the email leg started. It asks the victim to enter their Facebook username and password, then presents another fake multi-factor authentication (MFA) check to capture the one-time token.

Capturing the MFA code in real time is the part that matters most. Because the attacker collects the token at the moment it is generated, a static second factor does not stop account takeover — the stolen code is only useful for a short window, and the attackers are positioned to use it immediately. This means an account protected by SMS or app-based codes can still be compromised if the user completes the fake verification.

After harvesting login data, the page escalates to identity documents. It asks the victim to upload a photo of a passport, driver's license, or national ID card under the pretext of confirming their identity.

"Threat actors can leverage Meta business accounts to spend the victim's money on malicious or scam advertising, or they can take over the account entirely, changing the recovery methods and password, and leverage the account to transmit more targeted attacks at the business' customers or social media followers." — Andrew Brandt, Huntress

What the Data Enables

The combination of stolen credentials and a government ID photo gives the operators more than one account. With the login and a captured MFA token they can seize the business account, change the password and recovery methods, and lock the legitimate owner out. The ID image feeds separate identity-fraud and scam activity that can outlast the account compromise itself.

A hijacked Meta business account also has spending authority attached to it. Attackers can run fraudulent or scam advertising on the victim's payment method, and use the account's established reach to push further phishing at that business's customers and followers — extending the campaign through a source those recipients already trust.

Forensic Artifacts to Hunt For

The campaign leaves traces across both email and social channels. When reconstructing an incident, focus on artifacts tied to the two-track structure described above:

• Messenger conversation history with any account presenting as AI Strategic Partner or a similar "verification" or "brand protection" persona.
• Outbound links from Messenger or email that direct to non-Meta domains hosting login or "verify your account" pages — the credential-harvesting endpoints are external to the Facebook ecosystem.
• Browser history and cache entries showing visits to those verification pages, plus form-submission and autofill artifacts that indicate credentials or an MFA code were entered off-platform.
• Account activity logs showing password changes, recovery-method changes, or new advertising spend that the legitimate owner did not initiate.
• Message content containing spelling, grammatical, and formatting errors, and a "free" verification offer — inconsistencies that separate the lure from genuine Meta communications.

The activity ran from around November 2025 until June 2026, when Meta disrupted the infrastructure the operators depended on. Any Messenger or email interaction with the fake verification offer inside that window is worth treating as a potential compromise and investigating for the credential and identity-document exposure described above.

Business Impact on Social Media and Technology Teams

When attackers capture your Meta business account credentials, they gain a trusted channel to your customers, followers, and ad spend. Andrew Brandt of Huntress described what that access buys them: spending the victim's money on scam advertising, or taking over the account outright by changing recovery methods and the password.

"Threat actors can leverage Meta business accounts to spend the victim's money on malicious or scam advertising, or they can take over the account entirely, changing the recovery methods and password, and leverage the account to transmit more targeted attacks at the business' customers or social media followers," said Andrew Brandt, principal threat intelligence incident commander at Huntress.

For social media and technology teams, that last point matters most. Your Facebook presence is a broadcast platform your audience already trusts. When an attacker controls it, every message they push out carries your brand's credibility behind it, which is exactly what makes onward attacks against your customers effective.

The ad spend angle turns your account into a direct financial liability. An attacker with control of your Business account can run paid campaigns billed to your payment method, so you absorb the cost of advertising you never authorized. Recovering those funds from Meta is not guaranteed, and disputing the charges takes time your team does not have.

The identity documents make this worse than a typical credential grab. The campaign harvested passwords, MFA codes, phone numbers, email addresses, and photos of government ID or passports. That combination gives fraudsters what they need to:

• Impersonate your staff or executives when contacting Meta support or other services
• Answer knowledge-based verification questions using real personal data
• Build convincing follow-on scams aimed at your customers and partners

If you reuse the compromised password anywhere else — your email, your CRM, your ad tooling — the exposure spreads beyond Facebook. Attackers routinely test stolen credentials against other services, so a single Meta password captured through this phishing page can open doors across your stack. The stolen MFA codes lose their value quickly, but a reused static password does not.

Consider the data-flow risk if customer information passes through your Facebook business account. Messenger conversations, lead forms, and customer inquiries often contain personal data. If an attacker reads or exports that content after taking over the account, you may face notification obligations under privacy regulations depending on where your customers are located and what was exposed.

The reputational cost is harder to reverse than the financial one. When scam posts or fraudulent ads go out under your name, customers who fall for them associate the loss with your brand, not with the attacker. Cleaning up requires public acknowledgment, and some followers will disengage regardless of how you handle it.

Technology companies carry an added burden here. If your organization uses Facebook or Meta identity as a federated sign-on option, or if your teams authenticate to internal tools using the same credentials, an account takeover can extend past your public-facing presence into systems that hold source code, customer records, or infrastructure controls.

The campaign ran from around November 2025 until Meta disrupted the supporting infrastructure in June 2026. That is a long window, and any credentials or ID images submitted during it should be treated as compromised. The value of a stolen passport photo does not expire when the phishing site goes offline.

Detection and Immediate Response Actions

The single most important action is to check your Facebook account's active login sessions and recent login activity. In your Meta Business account settings, review the list of authenticated devices and locations. If you see sessions you don't recognize, or logins from unfamiliar geographies immediately after receiving a verification-themed message, revoke those active sessions and treat the account as compromised.

Because this campaign harvests passwords, MFA codes, and identity documents in a single flow, a stolen credential set may already be in attacker hands even if the account still appears functional. Speed matters here more than certainty.

Identify and Detect

Start by auditing where credentials could have been submitted. Look for these signals across your mail gateway, endpoints, and account logs:

• Messenger conversations referencing account verification, badge protection, or brand protection that direct users to an external page for login or document upload.
• Outbound web traffic to unfamiliar domains that host cloned Meta login and verification pages, especially requests carrying credential form submissions.
• Inbound email that passed sender authentication yet contains spelling, grammar, or formatting errors, broken graphics, and unexpected free-offer language.
• Account login events from new devices or locations shortly after a user interacted with a verification message.
• Changes to account recovery methods — recovery email or phone number edits — that your team did not initiate.

For SOC teams, build detections around the credential-submission step rather than the lure itself. Alert on POST requests to newly registered or low-reputation domains that mimic Meta's account-management paths, and correlate those with subsequent Facebook logins from anomalous sources. In environments Capstone manages, Adlumin flags authentication anomalies such as impossible-travel logins and post-phishing session activity across managed environments, so a credential captured through this campaign surfaces as a login deviation before the attacker changes recovery settings.

Respond (24–48 hours)

Once you confirm or suspect exposure, work through containment in order:

• Reset the Facebook password from a known-clean device, then re-enable two-factor authentication with a fresh method, since any previously entered MFA codes may have been captured.
• Review connected third-party apps and any single sign-on links tied to the business account, and remove integrations you cannot account for.
• Verify recovery email and phone entries are correct and controlled by your team.
• For any user who uploaded a government ID, passport, or driver's license during the fake verification step, treat that identity data as exposed and monitor for downstream fraud attempts against those individuals.

The identity documents are the part you cannot reset. A password change closes the account door, but a copied passport image stays useful to the attacker for fraud long after the login is secured.

Protect and Recover

After containment, reduce the odds of a repeat. Add mail-filtering and URL rules that block the known attacker domains and quarantine verification-themed messages that fail closer inspection, even when sender authentication passes.

Set an internal Messenger policy that routine account or verification requests are handled only inside official Meta account settings, never through a chat conversation or an emailed link. Then run short user-awareness training built around this specific lure: a free verified-badge offer, an unexpected message, and any request to enter credentials or upload ID outside Meta's own interface are the markers to stop on.

"Broken graphics, links that seem unfamiliar, and the unexpected arrival of an email inviting you to an exciting opportunity are all red flags. So if you receive a message like this and it seems not-quite-right, or unexpected, just trash that message. You have more to lose than you think," said Andrew Brandt of Huntress.

Document what happened and which accounts were touched, so the next verification-themed message that reaches an inbox is recognized and reported rather than clicked.

Hardening Facebook Account Security in Business Environments

The most effective control for business Facebook accounts is a hardware security key on every account with admin or publishing permissions. Physical keys resist the credential-and-MFA harvesting flow this campaign used, because a phishing page cannot replay a challenge tied to a specific hardware device. If your marketing lead or agency contractor holds page-admin rights, that account is the one to lock down first.

Once keys are issued, enforce strong, unique passwords for each business account and remove any shared logins. Password reuse across a personal profile and a business page means one phished credential set opens both.

Identify

Start by documenting exactly who has access. Build a short list of every employee, contractor, and agency partner with a role on your Meta Business account, and record what permission level each holds — full admin, page editor, ad manager, or analyst.

• Audit and remove inactive third-party apps that still hold Messenger or Facebook permissions. Old scheduling, chatbot, and analytics integrations often retain broad access long after you stop using them.
• Disable third-party Messenger integrations you are not actively running. Fewer connected apps means fewer paths an attacker can abuse to reach your customers.
• Enforce periodic recertification of access. Re-review the list quarterly and strip rights from anyone who changed roles or left.

Protect

Beyond hardware keys and unique passwords, restrict where logins can originate. Where your team works from predictable locations, configure login-location restrictions or IP allow-listing so authentication attempts from unexpected geographies are blocked or challenged.

For organizations that use Facebook as a single sign-on (SSO) provider for other services, apply conditional access policies at the identity layer. Flag or block sign-ins from unusual devices and countries, and require re-authentication when risk signals appear. This matters because a compromised Facebook credential that feeds SSO can extend an attacker's reach beyond the social account itself.

Detect

Turn on login alerts for every business account so any unrecognized sign-in generates a notification to an address the account holder monitors. Pair those alerts with monitoring at the identity layer.

Adlumin ITDR correlates authentication events across managed environments, so a Facebook SSO login from an unfamiliar device or region surfaces as an anomaly rather than a line buried in a provider's activity log. That gives your team a signal when stolen credentials are being tested, before the account is drained or repurposed.

Respond

If an account shows signs of takeover, remove connected apps and integrations immediately alongside resetting credentials. Attackers who reach an account often add their own app authorizations to keep access after a password change.

• Rotate the password and re-enroll MFA using a hardware key, not SMS or an authenticator app that was reachable through the phishing flow.
• Review and revoke every third-party app authorization on the account.
• Reset the SSO credential and force re-authentication on all downstream services if the Facebook account was used for single sign-on.

Recover

Confirm that recovery methods — backup email and phone number — still belong to your team, since account takeover commonly involves changing them. Restore correct recovery contacts and verify no unauthorized admins remain on the page.

Close by folding the incident into your access documentation. Update the permission list, note which integrations were removed, and set a recertification date so the same gaps do not reopen. A documented, regularly reviewed access list is what keeps a single phished login from turning into a standing foothold in your business presence.

Key Takeaway: Verify Verification Requests Outside Messenger

The rule to internalize is simple: legitimate Facebook verification never begins in your Messenger inbox or an unsolicited email. The real verification service lives inside your Meta account settings and runs as a paid subscription. If a verification offer reaches you through Messenger, an email link, or a chatbot conversation, treat it as fraudulent regardless of how polished the request looks.

When you receive any message promising a verified badge or account "protection," do not click the links or reply to the bot. Open a separate browser session, log directly into your Facebook account, and check the verification and settings pages there. If the offer is genuine, it will appear inside your logged-in account. If it does not, you have your answer.

The same discipline applies to identity requests. Facebook does not solicit photos of your passport, driver's license, or national ID through a chat window. Any channel asking you to upload those documents to "verify" an account should be closed and reported, not completed.

The cost of getting this wrong runs beyond a single account. A compromised set of credentials hands attackers your business page, your ad budget, and a trusted channel to your customers and followers. From there, they can push further phishing to the people who already trust your brand, turning one stolen login into damage that reaches your audience. Verifying the request through official channels keeps that chain from ever starting.