Phishers hijacking Facebook Pages using apps

Another phishing campaign come in action recently targeting Facebook accounts and company pages with millions of followers. Phishers continue to devise new fake apps for the purpose of harvesting confidential information.

Not a new method, but very creative phishing example in Facebook hacking scene, where hacker host a phishing page on Facebook app sub domain itself. Designed very similar to Facebook Security team with title 'Facebook Page Verification' and using Facebook Security Logo as shown in the screenshot posted above.

Phishing app URL: https://apps.facebook.com/verify-pages/
Application hosted on: https://talksms.co.uk/

The phishing page asking users to enter Page URL and Page Name that victim own and his Facebook login email ID with password. Once victim trapped in hacker web, the phisher records your information.

Another interesting fact is that, the phishing domain https://talksms.co.uk/ is a HTTPS site with with verified SSL from GeoTrust.

When someone has been phished, hacker hijack all there pages, Groups for his own use or selling purpose.

Three Facebook pages with millions of fans got hijacked last night by hacker using this phishing page and may be there can be many more victims that are right now unknown to us.

Hacker Pages are :

1. https://www.facebook.com/funHETU
2. https://www.facebook.com/getInspiration
3. https://www.facebook.com/bySmiles

We have informed Facebook security team about the issue, and hope that Facebook will suspend all similar phishing pages as soon as possible. Original Facebook Page Admin's also looking for help from Facebook team to get their pages back.