Phishing campaign uses fake Instagram support chatbot to hijack business accounts
Attackers deployed a phishing campaign using a fake Instagram support chatbot and fraudulent emails to trick Meta Business account users into providing credentials and adding malicious two-factor authentication methods. The campaign used spoofed communications resembling official Meta alerts to make the scam appear legitimate.
What happened
A phishing campaign detected by Cofense Phishing Defense Center targeted Meta Business account users with fake Instagram alert emails claiming ads were suspended due to violation of advertising laws. The emails, sent from a Salesforce address (noreply@salesforce.com) rather than Instagram's official support email, directed users to click a 'Check more Details' button.
Upon clicking the link, users were redirected to a fraudulent page (businesshelp-manager.com) mimicking a legitimate Meta Business page. After entering their name and business email, users encountered either a fake tech support chatbot or an instructional guide. The chatbot requested screenshots and personal information, while the guide provided step-by-step instructions on how to add a malicious Two-Factor Authentication method that would grant the attacker access via a fake 'SYSTEM CHECK' Authenticator app.
Reported impact
The scam aimed to hijack Meta Business accounts by obtaining user credentials and adding malicious 2FA login methods. Successful attacks would allow scammers to take control of business accounts and potentially disrupt daily business operations, causing businesses to lose access to their accounts and customers.
Index analysis
The phishing campaign employed multiple deception techniques including spoofed official communications, realistic-looking fraudulent pages, and a simulated chatbot support interface. The attackers invested effort in making emails and landing pages closely resemble official Meta communications to increase credibility and trick users into compliance.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.