30,000 Facebook Accounts Hacked via Google AppSheet Phishing Campaign

Vietnamese-linked threat actors conducted a large-scale phishing campaign targeting Facebook Business account owners, compromising approximately 30,000 accounts through a multi-cluster attack strategy known as AccountDumpling.

• •The operation used Google AppSheet (noreply@appsheet.com) to bypass email spam filters and distribute phishing emails impersonating Meta Support with urgent account deletion threats.
• •Four attack clusters were identified: Netlify-hosted fake help center pages, Vercel-hosted security check pages with bogus CAPTCHA, Google Drive-hosted PDFs, and fake job offer impersonations.
• •Attackers collected credentials, two-factor authentication codes, government ID photos, phone numbers, and personal information, exfiltrating data to Telegram channels.
• •Vietnamese suspect identified as "PHẠM TÀI TÂN" through metadata in Canva-generated PDFs used in the campaign.