Instead of relying only on the traditional Android Security Patch Level date, applications can now check whether important system components, modules, or kernel fixes are missing or available.

The new release includes AndroidX Security State 1.1.0 and Security State Provider 1.0.0. The libraries are aimed at applications where device security is especially important, including banking, healthcare, financial services, enterprise mobility, and Mobile Device Management platforms.

More Detailed Patch Information

Android devices do not receive every security update through the same channel. Some fixes come from the phone manufacturer, while other components can be updated through Google Play system updates. Linux kernel updates may follow separate Long-Term Support releases.

Because of this, a single patch date does not always provide a complete picture of a phone’s security.

The new Security State libraries can provide information about three different patch levels:

• Device Security Patch Level: The security level currently installed on the device.
• Published Security Patch Level: The latest security level published through the Android Security Bulletin.
• Available Security Patch Level: A security update that is available for the specific device but has not yet been installed.

The checks can cover:

• Android system components
• Modular system components
• Linux kernel versions

This gives applications a more detailed view of which parts of a device are protected and which may still require an update.

Useful for Banking and Enterprise Apps

The new APIs could allow security-sensitive applications to make decisions based on the actual security state of a device.

For example:

• A banking app could check for important pending security updates before allowing a high-value transaction.
• An enterprise app could verify that a managed phone meets the organization’s security requirements.
• A payment application could check whether relevant NFC security fixes have been installed.
• An application using Bluetooth could verify whether important Bluetooth-related vulnerabilities have been addressed.

Apps could also detect when an update is already available and direct users to Android Settings to install it rather than immediately blocking access.

The libraries can also support vulnerability-specific checks, allowing developers to look at whether fixes for particular security issues have been applied.

Better Visibility for Android Security

The Security State libraries can use Android security information to provide more accurate assessments of device protection.

Android 17 also adds support for Supplemental Patches XML, which allows manufacturers to report security fixes that have been applied before they appear in a complete monthly security patch.

This means an OEM can communicate that a particular vulnerability has already been fixed even when the device has not yet received a newer overall patch-level date.

The Security State Provider also gives update providers a standard way to report available updates to Android applications and management platforms.

Google is working with device manufacturers to bring their update systems into this broader framework.

Overall, the new libraries give developers and enterprise security teams a better way to understand Android patch status. Instead of judging security from a single date, applications can now look more closely at individual components and determine whether important fixes are installed, available, or still missing.

The post New Android Feature Flags Missing Security Updates appeared first on First Hackers News.

The feature is designed to keep selected chats on the user’s main phone instead of syncing them to WhatsApp Web, desktop apps, or other phones connected to the same account.

Restricted Chat was spotted in WhatsApp Android beta version 2.26.36.5, but it is still being developed and has not been released for beta testing yet.

WhatsApp has also not confirmed when the feature will become available to the public.

Restricted Chat Limits Access on Linked Devices

The new option appears to build on WhatsApp’s existing Advanced Chat Privacy controls. Rather than applying stronger restrictions to an entire account, users would be able to select individual conversations that need additional protection.

Once enabled, a restricted conversation is expected to remain available only on the primary phone.

It would not be synchronized with:

• WhatsApp Web
• WhatsApp desktop applications
• Secondary phones
• Other linked devices

This could be useful when users regularly connect their WhatsApp account to computers, tablets, or additional phones.

For example, a confidential conversation could remain on a person’s main smartphone while normal chats continue to work across their other connected devices.

The approach could also reduce the risk of sensitive messages being exposed through an unattended computer, shared workstation, or unknown linked session.

Useful for Sensitive Conversations

Restricted Chat could be particularly helpful for people handling confidential information, including:

• Business executives
• Journalists
• Security and incident response teams
• Legal professionals
• Activists
• Organizations handling sensitive customer or business data

The feature is also expected to retain several protections associated with Advanced Chat Privacy. These may include preventing chat exports, stopping media from automatically appearing in the device gallery, and restricting the use of messages with Meta AI.

However, Restricted Chat will not completely prevent information from being shared. Someone participating in the conversation could still manually copy information, photograph a screen, or share messages outside WhatsApp.

The feature is therefore better viewed as an additional access-control layer rather than a complete solution against data leaks.

For now, Restricted Chat remains under development on Android. Installing the identified beta version does not activate the feature, and WhatsApp has not provided a confirmed release date.

Until it becomes available, users should regularly review their Linked Devices and remove any sessions they do not recognize.

The post WhatsApp Adds Extra Protection for Private Chats appeared first on First Hackers News.

Along with this milestone, WhatsApp is introducing stronger two-step verification and additional information for calls from unknown numbers. These updates are designed to make accounts harder to compromise while helping users recognize potential scams.

The integration of WhatsApp passkeys is part of WhatsApp’s ongoing commitment to enhancing user safety and privacy.

Passkeys Make WhatsApp Accounts Safer

Passkeys allow users to sign in using security features already available on their devices, such as a fingerprint, Face ID, or screen lock. Unlike traditional passwords or SMS codes, passkeys use cryptographic credentials that remain securely associated with the user’s device.

This makes them much more resistant to phishing, credential theft, and other attacks that depend on tricking users into revealing login information.

WhatsApp has now reached more than 1 billion passkey users and is expanding support for people who use multiple devices or switch between Android and iPhone.

Users can manage their passkeys through Settings > Account > Passkeys, where they can add or review their available credentials.

The milestone is significant because messaging accounts contain valuable personal information and are increasingly targeted by attackers looking to steal conversations, impersonate users, or target their contacts.

Stronger Two-Step Verification

WhatsApp is also giving its two-step verification system a security upgrade. Instead of relying only on the traditional six-digit PIN, users can now create a stronger password.

The new password must be at least eight characters long, with at least one letter and one number. Users can also add special characters for additional protection.

A longer password provides a much larger combination of possible values than a short numeric PIN, making simple guessing and automated attacks more difficult.

Users who have been using an easy-to-guess PIN should take this opportunity to switch to a unique and stronger password.

More Context for Unknown Calls

WhatsApp is also adding another layer of protection against scams by providing more information when users receive calls from unknown numbers on Android.

The incoming call screen can show details such as whether the number is from another country or whether the caller shares a group with the recipient.

This additional context can help users pause before answering a suspicious call or responding to an unexpected request. That is particularly useful because many scams rely on urgency and social engineering rather than technical exploits.

Together, passkeys, stronger two-step verification, and improved caller information give WhatsApp users several layers of protection against phishing, account takeovers, and social-engineering attacks.

For users, the message is straightforward: enable passkeys when available, use a strong two-step verification password, and be cautious when dealing with unfamiliar callers or unexpected requests for sensitive information.

The post WhatsApp Strengthens Security With WhatsApp passkeys appeared first on First Hackers News.

The campaigns typically begin with short-lived advertisements featuring fake financial experts or deepfake videos. The ads promise exclusive stock tips and encourage people to join WhatsApp groups.

Once inside, victims are connected with a convincing “analyst” who provides a stock name, buying price and expected target. The advice appears professional, but the real goal is to create artificial demand and push the stock price higher.

Researchers at Group-IB discovered the activity while investigating two organized investment-fraud operations known as GoldBull and CoinLure.

How the Stock Scam Works

GoldBull uses advertisements designed to look like they come from trusted financial professionals. The ads are often available for only a short time, creating a sense of urgency.

Potential victims are filtered based on their location and redirected into WhatsApp groups. There, the fake analyst encourages members to purchase a genuine small-cap stock using their normal brokerage accounts.

Victims may also be asked to provide proof that they completed the purchase. This helps scammers generate enough buying activity to influence thinly traded stocks.

In one case, investors were told on November 6, 2025, to buy a NASDAQ-listed stock at $24.79, with a target price of $29. The stock eventually reached $27.87 on December 9, giving it a 12.4% gain.

The scammers used the opportunity to sell their own holdings. The promised $29 target was never reached, and by February, the stock had fallen to $14.27—about 42% below the victims’ original purchase price.

The scam therefore works without compromising a brokerage account. The victims make the trades themselves, while the scammers profit from the resulting price movement.

Fake Investment Platforms Add Another Layer

The related CoinLure operation takes a different approach by directing victims toward fake investment websites.

Scammers use search-engine pages, social media advertisements and even romance-based manipulation to attract potential victims. The fraudulent platforms are designed to look legitimate, with registration pages, identity checks and even fake trial balances.

After victims deposit money, they may be told they need to pay additional fees before they can withdraw it. Common excuses include taxes, insurance charges, minimum balance requirements, account upgrades and technical problems.

Some victims are later contacted by supposed recovery services that demand another payment to recover their funds.

Investigators found one CoinLure platform connected to 208 domains that shared templates, hosting infrastructure and contact information. This shows how one fraudulent website can be part of a much larger network.

For investors, rushed stock recommendations, guaranteed profits, deepfake financial advertisements and WhatsApp groups asking for proof of purchases should all be treated as major warning signs. Always verify investment advice independently and use official brokerage channels rather than links or instructions provided through suspicious chat groups.

The post Scammers Use WhatsApp to Manipulate Stocks appeared first on First Hackers News.

The feature is designed to address the growing use of more convincing scams, including messages created with the help of AI. Instead of sending messages to WhatsApp’s servers for analysis, Scam Alert uses a small machine learning model that runs directly on the user’s device.

Once enabled, the model examines messages from people who are not saved as contacts. It looks for patterns in the conversation and language that may indicate common scam techniques.

The message itself stays on the device during this process. WhatsApp says it does not automatically send messages to Meta, WhatsApp, or another third party for review. Users decide what happens next.

If a message appears suspicious, WhatsApp can display a warning to the recipient. The user can then choose to block the sender, report the conversation, continue chatting, or mark the conversation as trusted if they believe the warning is incorrect.

Privacy Is a Key Part of Scam Alert

WhatsApp says the system was designed around three main ideas: local processing, no automatic reporting, and user control.

The company still needs some information to understand how well the feature performs. Instead of collecting individual messages, WhatsApp uses a privacy-focused analytics system that gathers limited information such as how many warnings were displayed and what actions users took.

This information is processed using Trusted Execution Environments (TEEs) and additional privacy techniques before aggregated statistics are sent to Meta.

Protecting the AI Model

Another concern is making sure attackers cannot secretly deliver a modified version of the scam-detection model to specific users.

WhatsApp says each model version is published with a SHA-256 hash in an append-only transparency system before it is deployed. This creates a record that can be used to verify that the model has not been secretly changed.

Model downloads also use an Oblivious HTTP (OHTTP) relay, which helps prevent the server from directly linking a model request to a user’s IP address.

WhatsApp says even the process used to assign users to different model versions for testing happens locally on their devices rather than being controlled by the server.

Additional Security Controls

The company says Scam Alert was designed to protect against several types of threats, including outside attackers, malicious employees, and compromised third-party suppliers.

Its security measures include isolated confidential computing environments, encrypted memory, and additional protections around the systems running the analytics infrastructure.

Users can also check information about the feature through WhatsApp’s transparency controls. The in-app activity section shows details such as which messages were analyzed and which model version was used.

External Researchers Can Test the System

WhatsApp is also expanding its Bug Bounty program to cover parts of the Scam Alert technology, including the machine learning models and analytics infrastructure.

This gives security researchers an opportunity to look for weaknesses and verify whether the system is being used only for its stated purpose of detecting scams.

Limited Beta Release

Scam Alert is initially being introduced through a limited beta rollout. WhatsApp says it plans to continue testing the technology with security researchers before making it more widely available.

The company also plans to publish a technical white paper explaining how the system works in greater detail.

The approach reflects a growing focus on building AI-powered security features without giving up user privacy. Instead of sending private conversations to the cloud for analysis, WhatsApp is attempting to combine on-device AI, confidential computing, and transparency mechanisms to detect scams while keeping message content protected.

The post WhatsApp Scam Alert: New Protection Against Hackers appeared first on First Hackers News.

According to recent security research, while the overall number of blocked Android malware attacks declined during the second quarter of 2026, banking malware remains one of the most active mobile threats. Rather than disappearing, attackers are changing how their malware is packaged and deployed.

A Shift Toward Dropper-Based Attacks

A dropper is an application that appears harmless but is designed to download or activate malware after installation.

This approach allows attackers to hide the real banking Trojan during the initial app review process. Once the application is installed on a victim’s device, it can retrieve additional malicious components and begin targeting banking credentials.

By separating the delivery mechanism from the actual malware, cybercriminals can update or replace their payloads without creating entirely new malicious applications.

Malicious Apps Disguised as Legitimate Software

Researchers observed attackers disguising malware as legitimate Android applications, including utility and document reader apps.

In one campaign, a PDF reader displayed what appeared to be a routine software update notification. Instead of installing an update, the application downloaded banking malware onto the victim’s device.

These fake update prompts make malicious activity appear normal, increasing the likelihood that users will unknowingly install the malware.

Smarter Delivery Techniques

Modern Android droppers are becoming more selective in how they deliver malware.

Some applications first collect information about where they were downloaded and send that data to a command-and-control (C2) server. The server decides whether to deliver the malicious payload based on the installation source.

This selective delivery helps attackers avoid security researchers, automated analysis tools, and app store review systems while targeting real users.

Banking Malware Continues to Evolve

Security researchers also observed continued activity from well-known Android banking malware families, including Mamont and Creduz.

New variants are being released regularly, suggesting that malware operators are continuously testing new delivery techniques, improving evasion methods, and developing updated versions to avoid detection.

Why This Matters

The growing use of droppers shows that mobile threats are becoming more sophisticated. A reduction in traditional banking Trojan detections does not necessarily indicate a lower risk—it may simply reflect changes in how malware is delivered.

As attackers continue refining their techniques, users and organizations should remain cautious of applications that request unexpected updates or unnecessary permissions.

How to Stay Protected

To reduce the risk of Android banking malware:

• Install apps only from trusted sources.
• Keep Google Play Protect enabled.
• Avoid downloading apps from unofficial websites.
• Be cautious of unexpected in-app update requests.
• Review requested permissions before installing applications.
• Keep Android devices and applications updated.
• Use a reputable mobile security solution.

Conclusion

Android banking malware operators are shifting away from traditional delivery methods and increasingly relying on dropper applications to bypass security controls. As these techniques become more advanced, mobile users and organizations should strengthen their security practices, verify application sources, and remain alert to suspicious app behavior to reduce the risk of financial compromise.

The post Android Banking Malware Adopts New Evasion Techniques appeared first on First Hackers News.

The campaign primarily focused on compromising REDCap (Research Electronic Data Capture) servers, a widely used platform for managing clinical research databases and surveys. After gaining access, the attackers deployed custom malware called INFINITERED, harvested credentials, established persistence, and later abused enterprise email compliance rules to exfiltrate sensitive communications.

Campaign Overview

The operation demonstrates a sophisticated attack chain combining exploitation of public-facing applications, credential theft, malware deployment, persistence mechanisms, and stealthy data exfiltration.

Key Objectives

• Medical research intelligence
• Artificial Intelligence research
• Defense-related information
• Military health research Public health policy data

Researchers observed the activity from September 2023 through November 2025, indicating a highly patient and well-resourced espionage operation.

High-level attack flow used by UNC6508 to compromise research institutions and steal sensitive information.

Initial Access Through REDCap Servers

Why REDCap Was Targeted

REDCap is extensively used across:

• Hospitals
• Clinical research organizations
• Universities
• Government research programs
• Military health institutions

Because REDCap stores large volumes of research and patient-related information, it provides an attractive entry point for espionage-focused threat actors.

Researchers observed the attackers probing and exploiting vulnerable or legacy REDCap deployments exposed to the internet. Once access was obtained, they began internal reconnaissance and credential discovery activities.

Web Shell Deployment and Persistence

Following successful compromise, UNC6508 deployed a web shell identified as:

help.php

The web shell served multiple purposes:

• Persistent access
• File uploads
• Command execution
• Further malware deployment

This allowed the attackers to maintain long-term access even if passwords were changed or some security controls were implemented.

INFINITERED Malware Analysis

Three months after the initial intrusion, researchers observed deployment of a custom malware family called INFINITERED. This malware was specifically engineered to operate inside REDCap environments.

Modular architecture of INFINITERED malware used by UNC6508 to maintain persistence, harvest credentials, and execute commands within compromised REDCap environments.

Component 1 – Upgrade Interceptor

The malware monitors REDCap upgrade activities.

When administrators update REDCap, the malware automatically injects itself into newer versions, ensuring persistence across software upgrades

Component 2 – Credential Harvester

This module captures usernames and passwords entered into REDCap login pages.

Stolen credentials are stored within REDCap database tables and later retrieved by attackers.

Component 3 – Command-and-Control Backdoor

The third module acts as a fully functional backdoor.

Researchers found it could:

• Execute shell commands
• Upload files
• Download files
• Run SQL queries

Communication was hidden within HTTP cookie values, helping evade traditional detection mechanisms.

Abuse of Google Workspace for Data Exfiltration

One of the most interesting aspects of the campaign was the attackers’ use of legitimate Google Workspace functionality.

After obtaining administrative access, UNC6508 created a content compliance rule named:

Patroit

The rule automatically monitored emails containing specific keywords and forwarded matching messages to attacker-controlled Gmail accounts.

Attack Chain Breakdown

• External Reconnaissance
• Initial Compromise
• Persistence
• Privilege Escalation
• Intelligence Gathering

Potential Impact on Organizations

Organizations affected by this campaign could experience:

Research Theft

Loss of valuable intellectual property and scientific research.

Strategic Intelligence Exposure

Disclosure of defense and geopolitical information.

Credential Compromise

Unauthorized access to enterprise systems.

Regulatory Risks

Exposure of regulated healthcare and research data.

Alternative Indicators of Compromise (IOCs)

Security Recommendations

Upgrade REDCap Immediately

Remove legacy versions and apply the latest security updates.

Conduct Threat Hunting

Search for:

• help.php
• INFINITERED artifacts
• Unauthorized admin activity
• Credential harvesting indicators

The UNC6508 campaign highlights how modern nation-state threat actors are increasingly targeting research ecosystems to obtain strategic intelligence. By exploiting REDCap servers, deploying INFINITERED malware, and abusing legitimate cloud email features, the attackers maintained access for more than a year while collecting sensitive medical, defense, and technology research data. Organizations operating research platforms should prioritize patching, continuous monitoring, and proactive threat hunting to defend against similar espionage campaigns.

The post PRC-Linked Threat Actors Target REDCap Servers to Spy on U.S. Medical Research Organizations appeared first on First Hackers News.

The issue was initially noticed by a Motorola Razr 60 Ultra user who observed unusual behavior when opening the Amazon app. Instead of launching normally, the device briefly opened a web browser before redirecting back to Amazon with a tracking identifier attached.

Further investigation revealed that a preinstalled background application named Smart Feed was responsible for the redirects.

Hidden App Injects Affiliate Tracking Codes

Researchers found that the hidden app communicates with an external server identified as devicenative[.]com. The server appears to provide affiliate-related settings and redirect instructions used by the application.

When users tap shopping apps from the launcher, the hidden service intercepts the request and inserts affiliate tracking data before sending users to the final destination.

The observed behavior includes:

• Intercepting Amazon app launches
• Opening browser-based redirect links
• Injecting affiliate tracking parameters
• Connecting to remote servers for configuration updates
• Running silently in the background

Because Android automatically handles supported links inside apps, most users are unlikely to notice the redirection process.

Researchers Warn About Potential Risks

Security experts noted that the technique shares similarities with behaviors commonly seen in adware and mobile malware.

The concerns go beyond affiliate monetization because the same infrastructure could theoretically be modified to redirect users toward malicious websites, phishing pages, or credential theft portals.

Researchers also highlighted several worrying characteristics:

• Hidden system-level persistence
• External server-controlled behavior
• Intent interception techniques
• Limited user visibility or control
• Difficulty removing the application

Since the application relies on remote configuration from external servers, its behavior could potentially change without any operating system update.

The issue has currently been confirmed on the Motorola Razr 60 Ultra, although it is still unclear whether other Motorola devices are affected.

While reports suggest a third-party monetization partner may be involved, researchers argue that smartphone manufacturers remain responsible for software bundled with their devices.

Motorola has not publicly commented on the findings at the time of reporting.

The post Hidden Motorola App Redirects Amazon Traffic appeared first on First Hackers News.

Researchers from Mysk reported that WhatsApp uses a shared container linked to Meta applications, identified as group.com.facebook.family. On Apple devices, app group containers allow applications from the same developer to share data and resources.

Because Facebook, Instagram, and WhatsApp belong to the same ecosystem, the shared architecture could introduce privacy and security concerns if exploited alongside operating system vulnerabilities.

Shared Containers Raise Privacy Concerns

The researchers found that WhatsApp chat databases stored inside these containers are not encrypted at rest. This means the data may remain readable if attackers gain access to the device or exploit weaknesses in the operating system.

According to the report, the following risks were identified:

• Chat histories may be stored in plaintext
• Other Meta-owned apps could theoretically access shared data
• Users receive no alerts when such access occurs
• The issue affects both macOS and iOS environments

Researchers also demonstrated that WhatsApp chat histories could be extracted from iPhone backups, where the same unencrypted storage structure was observed.

The findings highlight an important distinction in security design. While WhatsApp uses end-to-end encryption to protect messages during transmission, that protection does not automatically secure data stored locally on the device.

macOS Vulnerability Increases Exposure Risk

The risk becomes more serious when combined with a recently disclosed macOS vulnerability tracked as CVE-2026-28910. The flaw affected Apple’s Archive Utility tool and reportedly allowed attackers to bypass App Sandbox protections.

By abusing this vulnerability, attackers could potentially:

• Access protected application containers
• Extract sensitive information from apps
• Bypass Apple’s Transparency, Consent, and Control protections
• Access chat histories from applications like WhatsApp

Researchers presented a proof-of-concept demonstration showing how the vulnerability could be combined with WhatsApp’s storage behavior to retrieve chat data.

Security Debate Around the Findings

Not all experts agree on the severity of the issue. WABetaInfo stated that although the databases may not be encrypted locally, Apple’s sandboxing system still provides strong isolation between applications.

From this perspective, attackers would still require elevated system privileges or a separate operating system exploit to access the stored data.

However, researchers at Mysk argue that shared app group permissions between Meta applications reduce isolation boundaries and increase the potential attack surface.

The discussion highlights broader concerns about local data protection in modern mobile ecosystems, especially when multiple applications share common storage environments.

Recommendations for Users

Security experts recommend several steps to reduce potential exposure risks:

• Enable encrypted Finder or iTunes backups
• Keep macOS and iOS updated with the latest security patches
• Use strong device passcodes and device encryption
• Limit unnecessary applications from the same developer ecosystem
• Regularly review application permissions and backup settings

At the time of reporting, there were no confirmed cases of widespread exploitation linked to the findings. However, the research highlights the importance of protecting sensitive data not only during transmission but also while stored on devices.

The post WhatsApp Chat Data Found Stored Without Encryption appeared first on First Hackers News.

Instead of relying on fake domains or compromised mail servers, attackers use Google AppSheet to send emails through Google’s own infrastructure. These messages are generated as part of automated workflows, meaning they pass authentication checks like SPF, DKIM, and DMARC without raising suspicion.

As a result, security tools and spam filters see them as trusted communications, allowing phishing messages to land directly in inboxes of targeted users—often business account owners managing Facebook pages.

Multi-Layered Attack Strategy

The campaign is not a single phishing page but a structured, multi-stage system designed to increase success rates. Victims are first directed to pages hosted on Netlify, where attackers replicate the Facebook Help Center with high accuracy. These pages are customized per victim using unique subdomains, making them difficult to block using traditional security measures.

From there, users are guided through a series of steps that collect not only login credentials but also deeper identity information such as date of birth and even government-issued ID images. In some cases, the attackers shift tactics by offering fake incentives, like verification badges, hosted on platforms such as Vercel. These pages are designed to look dynamic and legitimate, while quietly bypassing detection systems using techniques like hidden Unicode characters.

The operation becomes more advanced in later stages. Attackers host phishing documents on Google Drive, presenting them as official Meta notifications. These documents, often designed using Canva, contain embedded links that redirect victims into interactive phishing environments. These environments are powered by real-time communication frameworks, allowing attackers to actively engage with victims during the login process.

This live interaction is a critical aspect of the campaign. Instead of passively collecting credentials, attackers can request one-time passwords, monitor user actions, and even capture browser sessions as they happen. This significantly increases the likelihood of successful account takeover, even when multi-factor authentication is enabled.

Real-Time Data Exfiltration and Attribution

Once credentials are captured, they are immediately transmitted through a centralized system built around Telegram bots. This allows operators to monitor incoming data in real time and quickly take control of compromised accounts before victims notice suspicious activity.

Analysis of the infrastructure shows a strong operational scale, with thousands of records flowing into attacker-controlled channels. Most victims are concentrated in regions like the United States and Europe, indicating a focus on high-value targets such as businesses and influencers.

Investigators were also able to trace elements of the campaign back to Vietnamese actors. This attribution is supported by metadata found in phishing documents and developer comments embedded within the malicious code, providing insight into the origin of the operation.

A Shift Toward Industrialized Phishing

AccountDumpling reflects a broader shift in cybercrime, where phishing is no longer a simple tactic but part of a larger, industrialized ecosystem. Attackers are combining trusted services, automation, and real-time interaction to create highly effective campaigns that are difficult to detect and disrupt.

Compromised accounts are rarely the end goal. They are often reused for further scams, advertising fraud, or additional phishing attacks, creating a cycle that sustains and expands the operation. This approach shows how modern threat actors are leveraging legitimate platforms at scale, turning them into tools for widespread abuse while staying under the radar.

The post Facebook Phishing Campaign Targets Business Accounts appeared first on First Hackers News.