Facebook Accounts Hacked via Google AppSheet Phishing Campaign

A Vietnamese-linked operation, dubbed “AccountDumpling” by Guardio, has compromised approximately 30,000 Facebook accounts. The Hacker News reports that attackers are leveraging Google AppSheet as a “phishing relay” to distribute malicious emails designed to steal Facebook credentials. This sophisticated use of a legitimate cloud service for phishing bypasses traditional email security controls, making detection challenging for many organizations.

Once compromised, these Facebook accounts are not just for social engineering; The Hacker News indicates they are being sold through illicit online storefronts operated by the threat actors. This monetization strategy underscores the financial motivation behind the campaign, turning stolen access into direct profit for the attackers. The scale of 30,000 accounts signifies a significant, ongoing operation, not just a one-off attack.

This campaign highlights a critical shift in attacker tactics: abusing trusted platforms to lend legitimacy to phishing attempts. Defenders need to recognize that the mere presence of a Google domain in a URL no longer guarantees safety. Attackers are constantly evolving, finding new ways to weaponize legitimate infrastructure against unsuspecting users.